- Bump version to 3.2.0-10 - Resolves: RHEL-220500 - CVE-2026-18355 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [rhel-10.2.z] - Resolves: RHEL-222320 - CVE-2026-18453 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [rhel-10.2.z] - Resolves: RHEL-232863 - CVE-2026-18922 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property [rhel-10.2.z] - Resolves: RHEL-244470 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-10.2.z] - Resolves: RHEL-245372 - CVE-2026-76560 389-ds-base: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [rhel-10.2.z] - Resolves: RHEL-247859 - CVE-2026-78701 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS [rhel-10.2.z] - Resolves: RHEL-248770 - CVE-2026-11770 fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-10.2.z] - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [rhel-10.2.z] - Resolves: RHEL-210874 - CVE-2026-15722 389-ds-base: 389-ds-base: pre- authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [rhel-10.2.z] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN cache is disabled. - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral - Resolves: RHEL-92054 - Memory leak in roles_cache_create_object_from_entry [rhel-10] - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10] - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with world readable permission - Resolves: RHEL-107035 - CWE-532 Created user password hash available to see in audit log - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password changed by administrator - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS access and error logs - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] - Resolves: RHEL-5117 - ns-slapd crash in dbmdb_import_prepare_worker_entry() - Resolves: RHEL-31959 - [RFE] add plugin origin or source in security's log msg info - Resolves: RHEL-35241 - ns-slapd crashes in referral mode - Resolves: RHEL-61327 - Incomplete messages about replication in the errors log. - Resolves: RHEL-61353 - dbscan on replication changelog does not display MOD_TYPE - Resolves: RHEL-62874 - dsidm: issue when renaming users - Resolves: RHEL-65660 - DSIDM: Re-enabling user accounts that reached inactivity limit fails with error - Resolves: RHEL-67003 - dsconf backend replication monitor fails if replica id starts with 0 - Resolves: RHEL-67006 - dsconf utility should let you configure the "uniqueness-exclude-subtrees" parameter of the Attribute Uniqueness plug- in - Resolves: RHEL-67019 - Crash in __strlen_sse2 when using the nsRole filter rewriter. - Resolves: RHEL-67022 - Password modify extended operation should skip password policy checks when executed by root DN - Resolves: RHEL-70117 - Unify how group description can be added to a new group in WebUI and CLU - Resolves: RHEL-74085 - Increased memory consumption caused by NDN cache - Resolves: RHEL-74270 - [RFE] Implement "list-dn" option for dsidm tool in Directory Server - Resolves: RHEL-76832 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit - Resolves: RHEL-76837 - dsidm Error: float() argument must be a string or a number, not 'NoneType' - Resolves: RHEL-76840 - Monitoring tab should use dsconf monitor - Resolves: RHEL-77490 - Complete remove the parameter "nsslapd-subtree- rename-switch" from DS-12 - Resolves: RHEL-79080 - Json option does not work with "dsidm account get- by-dn" command - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS access and error logs - Resolves: RHEL-80253 - RHDS hangs when having online backup running together with automember_rebuild task executing - Resolves: RHEL-80497 - Can't rename users member of automember rule [rhel-10] - Resolves: RHEL-81277 - logconv.py fails when specific timestamps are provided - Resolves: RHEL-83850 - mdb database statistics don't work - Resolves: RHEL-86279 - Cannot create a nested role using "dsidm role create-nested" - Resolves: RHEL-86280 - Cannot create a filtered role using "dsidm role create-filtered" - Resolves: RHEL-86313 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" - Resolves: RHEL-86314 - dsidm failing with error "argument must be a string or a number" - Resolves: RHEL-86315 - Dsidm get_dn option fails for organizational unit, service and posixgroup - Resolves: RHEL-86316 - Dsidm uniquegroup members option does not work - Resolves: RHEL-86321 - dsidm role rename-by-dn does not rename a role - Resolves: RHEL-86322 - dsidm role subtree-status doesn't work - Resolves: RHEL-86323 - dsidm role get-by-dn doesn't work properly with -j option - Resolves: RHEL-86324 - Deleting a role with dsidm results in proper deletion message, but role is still present - Resolves: RHEL-86785 - dscontainer: support loading custom schema - Resolves: RHEL-86878 - segfault at 7ff2370010c8 ip 00007ff2339ba239 sp 00007fed321fe100 error 6 in liblmdb.so.0.0.0 - Resolves: RHEL-89748 - Nested group does not receive memberOf attribute - Resolves: RHEL-89774 - Improve the "result" field of ipa-healthcheck if replicas are busy [rhel-10] - Resolves: RHEL-89776 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] - Resolves: RHEL-95761 - Improve error message when bulk import connection is closed - Resolves: RHEL-97565 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy. - Resolves: RHEL-101926 - ipa-backup failed with error : 'No such file or directory: '/usr/sbin/dsctl' - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN cache is disabled. - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral - Resolves: RHEL-92054 - Memory leak in roles_cache_create_object_from_entry [rhel-10] - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10] - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with world readable permission - Resolves: RHEL-107035 - CWE-532 Created user password hash available to see in audit log - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password changed by administrator - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [rhel-10.2.z] - Resolves: RHEL-210874 - CVE-2026-15722 389-ds-base: 389-ds-base: pre- authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [rhel-10.2.z] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Bump version to 3.2.0-10 - Resolves: RHEL-220500 - CVE-2026-18355 389-ds-base: heap buffer overflow via SASL wrapped-record length lower-bound underflow in sasl_io_start_packet() [rhel-10.2.z] - Resolves: RHEL-222320 - CVE-2026-18453 389-ds-base: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search [rhel-10.2.z] - Resolves: RHEL-232863 - CVE-2026-18922 389-ds-base: SASL PLAIN authentication allows privilege escalation to Directory Manager via stale identity in Cyrus SASL auxiliary property [rhel-10.2.z] - Resolves: RHEL-244470 - lib389: set nsDS5ReplicaBindDNGroup before ensure_agreement() [rhel-10.2.z] - Resolves: RHEL-245372 - CVE-2026-76560 389-ds-base: anonymous LDAP client can defeat SELFDN ACI bind-rule checks via empty bind DN [rhel-10.2.z] - Resolves: RHEL-247859 - CVE-2026-78701 389-ds-base: CVE-2026-11610 incomplete fix may introduce a connection-stall DoS [rhel-10.2.z] - Resolves: RHEL-248770 - CVE-2026-11770 fix breaks replication total init when nsDS5ReplicaBindDNGroup is set after agreement creation [rhel-10.2.z] - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [rhel-10.2.z] - Resolves: RHEL-210874 - CVE-2026-15722 389-ds-base: 389-ds-base: pre- authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [rhel-10.2.z] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN cache is disabled. - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral - Resolves: RHEL-92054 - Memory leak in roles_cache_create_object_from_entry [rhel-10] - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10] - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with world readable permission - Resolves: RHEL-107035 - CWE-532 Created user password hash available to see in audit log - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password changed by administrator - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS access and error logs - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] - Resolves: RHEL-5117 - ns-slapd crash in dbmdb_import_prepare_worker_entry() - Resolves: RHEL-31959 - [RFE] add plugin origin or source in security's log msg info - Resolves: RHEL-35241 - ns-slapd crashes in referral mode - Resolves: RHEL-61327 - Incomplete messages about replication in the errors log. - Resolves: RHEL-61353 - dbscan on replication changelog does not display MOD_TYPE - Resolves: RHEL-62874 - dsidm: issue when renaming users - Resolves: RHEL-65660 - DSIDM: Re-enabling user accounts that reached inactivity limit fails with error - Resolves: RHEL-67003 - dsconf backend replication monitor fails if replica id starts with 0 - Resolves: RHEL-67006 - dsconf utility should let you configure the "uniqueness-exclude-subtrees" parameter of the Attribute Uniqueness plug- in - Resolves: RHEL-67019 - Crash in __strlen_sse2 when using the nsRole filter rewriter. - Resolves: RHEL-67022 - Password modify extended operation should skip password policy checks when executed by root DN - Resolves: RHEL-70117 - Unify how group description can be added to a new group in WebUI and CLU - Resolves: RHEL-74085 - Increased memory consumption caused by NDN cache - Resolves: RHEL-74270 - [RFE] Implement "list-dn" option for dsidm tool in Directory Server - Resolves: RHEL-76832 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit - Resolves: RHEL-76837 - dsidm Error: float() argument must be a string or a number, not 'NoneType' - Resolves: RHEL-76840 - Monitoring tab should use dsconf monitor - Resolves: RHEL-77490 - Complete remove the parameter "nsslapd-subtree- rename-switch" from DS-12 - Resolves: RHEL-79080 - Json option does not work with "dsidm account get- by-dn" command - Resolves: RHEL-80252 - [RFE] Structured (JSON) logging option for RHDS access and error logs - Resolves: RHEL-80253 - RHDS hangs when having online backup running together with automember_rebuild task executing - Resolves: RHEL-80497 - Can't rename users member of automember rule [rhel-10] - Resolves: RHEL-81277 - logconv.py fails when specific timestamps are provided - Resolves: RHEL-83850 - mdb database statistics don't work - Resolves: RHEL-86279 - Cannot create a nested role using "dsidm role create-nested" - Resolves: RHEL-86280 - Cannot create a filtered role using "dsidm role create-filtered" - Resolves: RHEL-86313 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" - Resolves: RHEL-86314 - dsidm failing with error "argument must be a string or a number" - Resolves: RHEL-86315 - Dsidm get_dn option fails for organizational unit, service and posixgroup - Resolves: RHEL-86316 - Dsidm uniquegroup members option does not work - Resolves: RHEL-86321 - dsidm role rename-by-dn does not rename a role - Resolves: RHEL-86322 - dsidm role subtree-status doesn't work - Resolves: RHEL-86323 - dsidm role get-by-dn doesn't work properly with -j option - Resolves: RHEL-86324 - Deleting a role with dsidm results in proper deletion message, but role is still present - Resolves: RHEL-86785 - dscontainer: support loading custom schema - Resolves: RHEL-86878 - segfault at 7ff2370010c8 ip 00007ff2339ba239 sp 00007fed321fe100 error 6 in liblmdb.so.0.0.0 - Resolves: RHEL-89748 - Nested group does not receive memberOf attribute - Resolves: RHEL-89774 - Improve the "result" field of ipa-healthcheck if replicas are busy [rhel-10] - Resolves: RHEL-89776 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response - Resolves: RHEL-95441 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] - Resolves: RHEL-95761 - Improve error message when bulk import connection is closed - Resolves: RHEL-97565 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy. - Resolves: RHEL-101926 - ipa-backup failed with error : 'No such file or directory: '/usr/sbin/dsctl' - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Resolves: RHEL-73032 - segfault - error 4 in libpthread-2.28.so - Resolves: RHEL-79079 - Failure to get Server monitoring data when NDN cache is disabled. - Resolves: RHEL-87352 - ns-slapd crashed when we add nsslapd-referral - Resolves: RHEL-92054 - Memory leak in roles_cache_create_object_from_entry [rhel-10] - Resolves: RHEL-107001 - ipa-restore fails to restore SELinux contexts, causes ns-slapd AVC denials on /dev/shm after restore. [rhel-10] - Resolves: RHEL-107028 - CWE-284 dirsrv log rotation creates files with world readable permission - Resolves: RHEL-107035 - CWE-532 Created user password hash available to see in audit log - Resolves: RHEL-107037 - CWE-778 Log doesn't show what user gets password changed by administrator - Bump version to 3.2.0-9 - Resolves: RHEL-183075 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-10.2.z] - Resolves: RHEL-190776 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control plugin BER parser [rhel-10.2.z] - Resolves: RHEL-210874 - CVE-2026-15722 389-ds-base: 389-ds-base: pre- authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica ID parsing [rhel-10.2.z] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-10.2.z] - Bump version to 3.2.0-7 - Resolves: RHEL-170271 - DS 12 does not handle escape char in bind user [rhel-10.2.z] - Resolves: RHEL-170276 - dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] - Resolves: RHEL-170281 - Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] - Resolves: RHEL-170363 - access log - suspicious wtime optime negative and large values in internal op [rhel-10.2.z] - Resolves: RHEL-170478 - An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] - Resolves: RHEL-170481 - dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] - Resolves: RHEL-170515 - Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] - Resolves: RHEL-174526 - [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] - Resolves: RHEL-178074 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-10.2] - Resolves: RHEL-180718 - Online export is failing when using the option "-s" [rhel-10.2.z] - Resolves: RHEL-183897 - Server shutdown during online reindex may lead to data loss [rhel-10.2.z] - Resolves: RHEL-183898 - Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] - Resolves: RHEL-183899 - Replication errors in logs [rhel-10.2.z] - Resolves: RHEL-183900 - Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] - Bump version to 3.2.0-6 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Bump version to 3.2.0-5 - Bump version to 3.2.0-4 - Resolves: RHEL-86312 - Crash in trim_changelog() during the Retro Changelog trimming. - Resolves: RHEL-133085 - Replica installation is failing with message MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED - Resolves: RHEL-137072 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-10.2] - Resolves: RHEL-138729 - Crash ( Segmentation fault ) in atomic_compare_exchange() - Bump version to 3.2.0-3 - Resolves: RHEL-76835 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. - Resolves: RHEL-86320 - [RFE] Support updating/renewing TLS certificate without restarting slapd - Resolves: RHEL-110192 - ns-slapd doesn't support PQC keys - Resolves: RHEL-111220 - RHDS-11.9 dsctl db2index --attr recreates all indexes instead of selected ones - Resolves: RHEL-111931 - Improve error messages for dsconf localpwp list - Resolves: RHEL-121981 - Setting password history count to 0 does not flush history - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Resolves: RHEL-146769 - Remove memberof_del_dn_from_groups from MemberOf plugin - Resolves: RHEL-137786 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication - Update to 3.2.0 - Resolves: RHEL-18041 - [RFE] When there are multiple backends cache auto- tune should adapt its tuning - Resolves: RHEL-58682 - [RFE] modify entry cache eviction strategy to allow large groups to stay in the cache - Resolves: RHEL-64019 - Units for changing MDB max size are not consistent across different tools - Resolves: RHEL-83274 - Replication online reinitialization of a large database gets stalled. - Resolves: RHEL-83852 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX - Resolves: RHEL-86534 - [RFE] Support Dynamic Groups similar to OpenLDAP - Resolves: RHEL-89601 - (&(cn:dn:=groups)) no longer returns results - Resolves: RHEL-94025 - PAM Pass Through Authentication Plugin processes requests for accounts that do not meet the criteria specified in the `pamFilter` option. - Resolves: RHEL-95395 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. - Resolves: RHEL-96196 - Duplicate/double local password policy entry display from redhat directory server webconsole - Resolves: RHEL-99331 - [RFE] Need an option with dsconf to delete all the conflicts at once instead of deleting each conflict one after the other - Resolves: RHEL-105578 - IPA health check up script shows time skew is over 24 hours - Resolves: RHEL-106502 - Ignore the memberOfDeferredUpdate setting when LMDB is used. - Resolves: RHEL-106559 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default - Resolves: RHEL-106849 - Abort the offline import if the root entry cannot be added. - Resolves: RHEL-107003 - Improve output dsctl dbverify when backend does not exist - Resolves: RHEL-109113 - [RFE] memberOf plugin - Add scope for specific groups - Resolves: RHEL-111219 - Attribute uniqueness is not enforced upon modrdn operation - Resolves: RHEL-113965 - RetroCL plugin generates invalid LDIF - Resolves: RHEL-115179 - Several password related attributes are not replicating from the Replicas to the Masters - Resolves: RHEL-115484 - ns-slapd crash in libdb, possible memory corruption - Resolves: RHEL-116060 - Fix paged result search locking - Resolves: RHEL-117124 - Missing access JSON logging for TLS/CLient auth - Resolves: RHEL-117140 - Changelog trimming - add number of scanned entries to the log - Resolves: RHEL-117520 - Typo in errors log after a Memberof fixup task. - Resolves: RHEL-121208 - [RFE] Make nsslapd-haproxy-trusted-ip accept whole subnets - Resolves: RHEL-122625 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. - Resolves: RHEL-122674 - [WebUI] Replication tab crashes after enabling replication as a consumer - Resolves: RHEL-123220 - Improve the way to detect asynchronous operations in the access logs - Resolves: RHEL-123275 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue - Resolves: RHEL-123663 - Online initialization of consumers fails with error -23 - Resolves: RHEL-123664 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly - Resolves: RHEL-123762 - 389-ds-base OpenScanHub Leaks Detected - Resolves: RHEL-124694 - Access logs are not getting deleted as configured. - Resolves: RHEL-126535 - memory corruption in alias entry plugin - Resolves: RHEL-128906 - Scalability issue of replication online initialization with large database - Resolves: RHEL-129675 - Can't locate CSN error seen in errors log when replicating after importing data from ldif files - Resolves: RHEL-131129 - ns-slapd[2233]: segfault at 0 ip 00007f1f1d7cd7fc sp 00007f1e775fc070 error 4 in libjemalloc.so.2[7f1f1d738000+ac000] on 389-ds-base-2.6.1-11 - Resolves: RHEL-133795 - Memory leak observed in ns-slapd with 389-ds- base-2.6.1-12 - Resolves: RHEL-139826 - Rebase 389-ds-base to 3.2.x - Resolves: RHEL-101727 - The numSubordinates value is not matching the number of direct children. - Resolves: RHEL-101783 - RHDS12: Web console doesn't show Server Version - Resolves: RHEL-109018 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules - Resolves: RHEL-111224 - Error showing local password policy on web UI - Resolves: RHEL-112675 - Statistics about index lookup report a wrong duration - Resolves: RHEL-112689 - Crash if repl keep alive entry can not be created - Resolves: RHEL-112722 - Exception thrown by dsconf instance repl get_ruv - Resolves: RHEL-113969 - AddressSanitizer: memory leak in memberof_add_memberof_attr - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Hard link manpages to avoid duplication - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX-format license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Some more static analysis fixes (RHEL-38991) - Add patches for a couple of bugs that make static analysis unhappy (RHEL-38991) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.22.0 - Rebuilt for RHBZ#2226577 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.20.6 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Some more static analysis fixes (RHEL-38991) - Add patches for a couple of bugs that make static analysis unhappy (RHEL-38991) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.22.0 - Rebuilt for RHBZ#2226577 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.20.6 - Update to 1.56.0 - Update to 1.56.0 (rc2) - Fix CVE-2025-9615 (RHEL-111772) - Update to 1.56.0 (rc1) - Support setting protocol version of HSR/PRP (RHEL-100764) - Support interlink for HSR/PRP (RHEL-100768) - Reject connections if the corresponding feature is disabled or removed (RHEL-93829) - Improve logging of networking off (RHEL-103925) - Don't delete unrelated OVS ports (RHEL-120176) - Update to 1.55.4 (dev) - Adding a VF configuration resets and re-configures all other VFs (RHEL-95844) - Fix connection.autoconnect-ports of OVS ports (RHEL-93876) - Global DNS config without domains silently ignored from D-Bus (RHEL-109853) - Add support for a DHCP client-id kernelarg (RHEL-108454) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102318) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-104357) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102774) - Allow setting IP method to disabled in port connections (RHEL-90756) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-69125) - Fix a race condition in ovs tun interface (RHEL-17358) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-89914) - Crash on _l3cfg_notify_cb (RHEL-92020) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83058) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-89582) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-70484) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-1794) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-83752) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-86767) - Update to 1.53.3 (dev) - Add more IPv6 prefix delegation options (RHEL-81948) - Fix order of parsing port/controller properies in nmcli (RHEL-80273) - Improve interface activation logic (RHEL-80157) - Fix WireGuard IPv6 firewall rules (RHEL-79975) - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-78769) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-211105) - Update to 1.56.0 - Update to 1.56.0 (rc2) - Fix CVE-2025-9615 (RHEL-111772) - Update to 1.56.0 (rc1) - Support setting protocol version of HSR/PRP (RHEL-100764) - Support interlink for HSR/PRP (RHEL-100768) - Reject connections if the corresponding feature is disabled or removed (RHEL-93829) - Improve logging of networking off (RHEL-103925) - Don't delete unrelated OVS ports (RHEL-120176) - Update to 1.55.4 (dev) - Adding a VF configuration resets and re-configures all other VFs (RHEL-95844) - Fix connection.autoconnect-ports of OVS ports (RHEL-93876) - Global DNS config without domains silently ignored from D-Bus (RHEL-109853) - Add support for a DHCP client-id kernelarg (RHEL-108454) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102318) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-104357) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102774) - Allow setting IP method to disabled in port connections (RHEL-90756) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-69125) - Fix a race condition in ovs tun interface (RHEL-17358) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-89914) - Crash on _l3cfg_notify_cb (RHEL-92020) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83058) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-89582) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-70484) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-1794) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-83752) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-86767) - Fix arp_missed_max error on 802.3ad bond reapply (RHEL-211105) - Update to 1.56.0 - Update to 1.56.0 (rc2) - Fix CVE-2025-9615 (RHEL-111772) - Update to 1.56.0 (rc1) - Support setting protocol version of HSR/PRP (RHEL-100764) - Support interlink for HSR/PRP (RHEL-100768) - Reject connections if the corresponding feature is disabled or removed (RHEL-93829) - Improve logging of networking off (RHEL-103925) - Don't delete unrelated OVS ports (RHEL-120176) - Update to 1.55.4 (dev) - Adding a VF configuration resets and re-configures all other VFs (RHEL-95844) - Fix connection.autoconnect-ports of OVS ports (RHEL-93876) - Global DNS config without domains silently ignored from D-Bus (RHEL-109853) - Add support for a DHCP client-id kernelarg (RHEL-108454) - Update to 1.54.0 - Fix reaply on bridge port VLAN (RHEL-102318) - Accept hostnames longer than 64 characters from DNS lookup (RHEL-104357) - Update to 1.54.0 (rc3) - Fix ipv6 static route deleted with dualstack (RHEL-102774) - Allow setting IP method to disabled in port connections (RHEL-90756) - Update to 1.54.0 (rc2) - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-69125) - Fix a race condition in ovs tun interface (RHEL-17358) - Update to 1.54.0 (rc1) - Devices not becoming managed sometimes (RHEL-89914) - Crash on _l3cfg_notify_cb (RHEL-92020) - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610) - Update to 1.53.4 (dev) - initrd: add new NBFT parser (RHEL-83058) - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-89582) - Support reapply on OVS settings (RHEL-86877) - Add support for configuring the loopback interface in nmtui (RHEL-70484) - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-1794) - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-83752) - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-86767) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Correct SPDX expression syntax - operators must be uppercase - Update to 2.0.36 - Bump release for June 2024 mass rebuild - Update to 2.0.34 (rhbz#2105023) - Resolve issues found by rpmdiff - add a patch to fix getaddrinfo detection to avoid using gethostbyname - add explicit Requires: on subpackages to avoid the need to test interoperability between the various combinations of old and new subpackages - Conditional Perl & Python module build, by default disabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix C compatibility issues - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license format - Fix CVE-2026-41651 - Related: RHEL-39682 (Backport upstream patches to fix recent regressions) - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Resolves: RHEL-39682 (Mark PackageKit as compulsory in AppStream metadata) - 1.19.0 Resolves: RHEL-109197 - 1.17.0 Resolves: RHEL-70412 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to new upstream release 1.15.4 (#2252258) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.2.4 - Add fix for building against PipeWire 1.3.x Resolves: RHEL-77078 Initial commit on c10s Resolves: RHEL-77078 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Gating enablement rebuild (RHEL-52092) - Bump release for June 2024 mass rebuild - SPDX license tags. - 1.6.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream patches to fix C type errors - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Allow "Lastname, Firstname" in /etc/passwd Resolves: RHEL-12265 - Backport changes from Fedora 40 Resolves: RHEL-78526 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update source tree to 20240322 version from upstream. NB: this update is done in conjunction with removing s390x support due to the large number of patches that are now rendered obsolete. Closes BZ#2138250. - Note, too, that the upstream version of the tarball is missing two commits and has the wrong name; discussed this with upstream and included a patch with the two commits to correct this, and renamed the tarballs to try to maintain consistency. So, upstream is actually named version 20240321, but it should be 20240322 according to their own git tree (see tag G20240322 on github). - Removed executable bit from all the upstream source files - Remove big-endian support, aka s390x. Closes BZ#2298855. - Remove several 32-bit only patches that are also obsolete since they are for unsupported architectures (thanks to pbonzini and PR#5). - Remove PIE patches since that is currently the default (again, thanks to pbonzini and PR#5) - Resolves: RHEL-66144 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 46.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 46.alpha - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 45.beta - 10.2 stable - Fix codename - Add RELEASE_TYPE field to os-release - Add support for i686 architecture - 10.2 beta - 10.1 stable - 10.1 beta - Redefine __cflags_arch_x86_64_level and __cflags_arch_x86_64 macroses for x86_64_v2 - Enable CRB repository by default - 10.0 stable release - Fix greenboot-rs preset services - Remove greenboot-set-success.target - 10.2 stable - Fix codename - Add RELEASE_TYPE field to os-release - Add support for i686 architecture - 10.2 beta - 10.1 stable - 10.1 beta - Redefine __cflags_arch_x86_64_level and __cflags_arch_x86_64 macroses for x86_64_v2 - Enable CRB repository by default - Enable Btrfs support for AlmaLinux - Apply AlmaLinux patches - Enable live subpackage by default on AlmaLinux - pyanaconda: storage: platform: Raise /boot to 2 GiB (neal) Resolves: RHEL-151547 - Fix user input in driver disk menu is not displayed (adamkankovsky) Resolves: RHEL-58828 - flatpak: tests: fix unreachable code (fsouza.bruno) Related: RHEL-143566 - flatpak: Only override remote URLs when subscription module is available (bciconel) Related: RHEL-143566 - flatpak: Make installation failures non-blocking (bciconel) Resolves: RHEL-143566 - Reload installer SELinux policy at exit so dracut shutdown works (k.koukiou) Resolves: RHEL-144456 - storage: stop creating /etc/mtab symlink during installation (k.koukiou) Related: RHEL-135116 - rescue: Add warning for immutable systems (k.koukiou) Related: RHEL-135116 - rescue: detect OSTree deployments in rescue mode and show deployment path (k.koukiou) Resolves: RHEL-135116 - pyanaconda: storage: fix FindExistingSystems API for ostree based OSes (k.koukiou) Related: RHEL-135116 - network: List all network interfaces IP for RDP session (ppolawsk) Resolves: RHEL-74268 - installation: run subscription tasks after network configuration (bciconel) Resolves: RHEL-135111 - subscription: ensure /var/lib/insights exists before running insights-client (bciconel) Resolves: RHEL-135111 - spec: Require zram-generator-defaults for RHEL-10 (k.koukiou) Resolves: RHEL-117685 - Only show compatible translations in text mode (mkolman) Resolves: RHEL-16168 - payloads: flatpak: fix SSL error detection on older Python versions (bciconel) Related: RHEL-141069 Resolves: RHEL-142694 - ostree needs to have /boot be bindmounted into sysroot (k.koukiou) Resolves: RHEL-66155 - modules: rpm_ostree: allow /boot/efi mount point in bootc installation (k.koukiou) Resolves: RHEL-141155 - rhsm: add --flatpak-registry-url support (bciconel) Resolves: RHEL-132652 - flatpak: handle self-signed certificate errors in registry sources (bciconel) Resolves: RHEL-132652 - flatpak: add utility to check for self-signed certificate errors (bciconel) Resolves: RHEL-132652 - Fix permissions of the ssh config created by Anaconda (ppolawsk) Resolves: RHEL-99673 - Add x-initrd.attach to /etc/crypttab device for / volumes (mkolman) Resolves: RHEL-112702 Related: RHEL-132666 - Remove --root-mount-spec to enable bootc's btrfs subvolume auto-detection (k.koukiou) Related: RHEL-58215 - bootc: Collect kernel arguments before installation to pass to bootc (k.koukiou) Related: RHEL-58215 - bootc: Bind mount /boot into sysroot for %post scripts (k.koukiou) Related: RHEL-58215 - pyanaconda: bootc: specify the bootloader to grub for bootc (k.koukiou) Related: RHEL-58215 - Add bootc installation method (ppolawsk) Resolves: RHEL-58215 - Include bootc command in expected pykickstart commands (ppolawsk) Related: RHEL-58215 - Update to upstream version 1.10.15 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52715 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Drop patch removing tools.jar from test classpath - Fix source tarball URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.10.15 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52715 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Drop patch removing tools.jar from test classpath - Fix source tarball URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.10.15 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52715 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Drop patch removing tools.jar from test classpath - Fix source tarball URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.10.15 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52715 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Drop patch removing tools.jar from test classpath - Fix source tarball URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - RPMAUTOSPEC: unresolvable merge - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix improper access control vulnerability - Resolves: CVE-2025-48734 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix improper access control vulnerability - Resolves: CVE-2025-48734 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.9.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.6.0 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 1.17.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 1.16.0 - Use implicit maven toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52709 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52709 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52709 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 1.27.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.25.0 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Port to apache-commons-parent 65 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix RHBZ #2171437 (FTBFS) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Port to apache-commons-parent 65 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix RHBZ #2171437 (FTBFS) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 2.16.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Build with Jurand instead of deprecated javapackages-extra - Update to upstream version 2.13.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to apache-commons-parent 65 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.14.0 - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.3.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.3.0 - Rebuild - Build with log4j support in non-bootstrap mode - Convert the License tag to SPDX - Update the project URL - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.10.0 - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 66 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable moditect-maven-plugin - Update to upstream version 65 - Rebuild - Update to upstream version 61 - Update to upstream version 33 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 31 - Rebuild - Update to upstream version 30 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Port to maven-verifier 2.0.0~M1 - Update to upstream version 1.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-43437 Disable stemming support and remove build requirement "libstemmer-devel" - Backport patch to fix installing swcatalog - Resolves: RHEL-31497 (Backport latest build from Fedora 40) - Update to 1.0.2 - Clean up some pre-1.0 scriptlet cruft - Resolves: RHEL-31497 (Backport latest bulid from Fedora 40) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.1 - Update to 1.0.0 final - Rebase to 1.0.0 git snapshot - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-43437 Disable stemming support and remove build requirement "libstemmer-devel" - Backport patch to fix installing swcatalog - Resolves: RHEL-31497 (Backport latest build from Fedora 40) - Update to 1.0.2 - Clean up some pre-1.0 scriptlet cruft - Resolves: RHEL-31497 (Backport latest bulid from Fedora 40) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.1 - Update to 1.0.0 final - Rebase to 1.0.0 git snapshot - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-43437 Disable stemming support and remove build requirement "libstemmer-devel" - Backport patch to fix installing swcatalog - Resolves: RHEL-31497 (Backport latest build from Fedora 40) - Update to 1.0.2 - Clean up some pre-1.0 scriptlet cruft - Resolves: RHEL-31497 (Backport latest bulid from Fedora 40) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.1 - Update to 1.0.0 final - Rebase to 1.0.0 git snapshot - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-43437 Disable stemming support and remove build requirement "libstemmer-devel" - Backport patch to fix installing swcatalog - Resolves: RHEL-31497 (Backport latest build from Fedora 40) - Update to 1.0.2 - Clean up some pre-1.0 scriptlet cruft - Resolves: RHEL-31497 (Backport latest bulid from Fedora 40) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.1 - Update to 1.0.0 final - Rebase to 1.0.0 git snapshot - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52710 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Re-enable maven plugin for RHEL 10+ - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52710 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Re-enable maven plugin for RHEL 10+ - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52710 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Conditionally disable bnd-maven-plugin - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Re-enable maven plugin for RHEL 10+ - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - fix invalid escape sequence (#2220936) - Rebuilt for Python 3.12 - Fix build with pip 23.1.2+ - Fixes: rhbz#2209018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to version 0.60.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to version 0.60.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove dependency on junit5-bom - Update to upstream version 3.24.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-24400: add XXE protection to XmlStringPrettyFormatter - Resolves: RHEL-183469 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix: fails to parse /etc/fstab when there is a double comma after character resolves: RHEL-77279 - Fix: fails to parse /etc/iproute2/README and /usr/share/iproute2/ resolves: RHEL-113748 - Synchronize spec file with Fedora - lenses/tmpfiles.aug: Permit '$' character in /usr/lib/tmpfiles.d/*.conf resolves: RHEL-76283 - lenses/multipath.aug: Support all possible values for find_multipaths - lenses/systemd.aug: Allow "+"(fullprivileges) command flag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide version resolves: RHEL-55741 - Fix parsing of /etc/fstab resolves: RHEL-55741 - New upstream version 1.14.1 - Use github tarballs again. - New binary augprint. - New bash-completions subpackage. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for CVE-2024-52615 (RHEL-67715) - Rebase to 0.9-rc2 (RHEL-78770) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix file attributes of /run/avahi-daemon (RHEL-55762) - fix SAST issues (RHEL-40016) - TigerVNC won't be shipped in RHEL 10, prefer GNOME Connections instead - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Avoid libfaketime and python-freezegun deps in RHEL builds - Fix DST-related test failures - Update to 2.12.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Avoid libfaketime and python-freezegun deps in RHEL builds - Fix DST-related test failures - Update to 2.12.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix issues identified by OpenScanHub Resolves: RHEL-44649 - Bump release for June 2024 mass rebuild - Update patch for audit logs Resolves: RHEL-22619 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to bash-5.2 patchlevel 26 Resolves: #2259619 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix another C compatibility issue in the configure script - Update to bash-5.2 patchlevel 21 Resolves: #2248970 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with LLVM 21 (RHEL-108333) - Rebuild in a side-tag - Rebase to version 0.35.0 (RHEL-79002) - Fix bpf-ksnoop (RHEL-93852) - Fix bpf-javagc (RHEL-75531) - Fix bio* tools tracepoints (RHEL-99677) - Rebase to the latest version (RHEL-78921) - Rebuild with LLVM 20 (RHEL-81772) - Silence warning of trace tools (RHEL-68952) - Fix bpf-runqlen (RHEL-91190) - Fix sslsniff and sofdsnoop (RHEL-58348) - Fix slabratetop (RHEL-58810) - Fix funclatency funcslower and gethostlatency on s390x (RHEL-68947) - Fix bpf-klockstat on aarch64 and ppc64 (RHEL-83001) - Remove unsupported bpf-bcachefs* and bpf-zfs* tools (RHEL-75529) - Fix multiples ppc64 tools (RHEL-58147) - Rebase to the latest version (RHEL-63886) - Fix gating tests of libbpf gating. - Explicitely disable blazesym support (RHEL-65850) - Fix LLVM 19 build (RHEL-64925) - Remove python3-pyelftools dependency (RHEL-60064) - Rebuild with LLVM 21 (RHEL-108333) - Rebuild in a side-tag - Rebase to version 0.35.0 (RHEL-79002) - Fix bpf-ksnoop (RHEL-93852) - Fix bpf-javagc (RHEL-75531) - Fix bio* tools tracepoints (RHEL-99677) - Rebase to the latest version (RHEL-78921) - Rebuild with LLVM 20 (RHEL-81772) - Silence warning of trace tools (RHEL-68952) - Fix bpf-runqlen (RHEL-91190) - Fix sslsniff and sofdsnoop (RHEL-58348) - Fix slabratetop (RHEL-58810) - Fix funclatency funcslower and gethostlatency on s390x (RHEL-68947) - Fix bpf-klockstat on aarch64 and ppc64 (RHEL-83001) - Remove unsupported bpf-bcachefs* and bpf-zfs* tools (RHEL-75529) - Fix multiples ppc64 tools (RHEL-58147) - Rebase to the latest version (RHEL-63886) - Fix gating tests of libbpf gating. - Explicitely disable blazesym support (RHEL-65850) - Fix LLVM 19 build (RHEL-64925) - Remove python3-pyelftools dependency (RHEL-60064) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 6.8.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 6.8.0 - Convert License tag to SPDX format - Add missing build-requires - Update to upstream version 6.7.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix license directory permissions - Resolves: rhbz#2144648 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix license directory permissions - Resolves: rhbz#2144648 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofing attacks (CVE-2025-40778) - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Move named.* files from /var/named into /usr/share/named - Move named.ca into /etc/named.ca - Fix failures in idna system test (RHEL-66172) - Decode IDN names on input in all situations in utilities (RHEL-66172) - logrotate: skip if empty and remove old variants (RHEL-113942) - Add runtime tunable limit by environment NAMED_MAXADDITIONAL (RHEL-84006) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Add new root key 38696 into package files too (RHEL-252999) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563) - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274) - Reject oversized negative cached records early (CVE-2026-19667) - Set limit to following HTTPS/SVCB aliases (CVE-2026-81736) - Add new root key 38696 into package files too (RHEL-252999) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofing attacks (CVE-2025-40778) - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Move named.* files from /var/named into /usr/share/named - Move named.ca into /etc/named.ca - Fix failures in idna system test (RHEL-66172) - Decode IDN names on input in all situations in utilities (RHEL-66172) - logrotate: skip if empty and remove old variants (RHEL-113942) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofing attacks (CVE-2025-40778) - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Move named.* files from /var/named into /usr/share/named - Move named.ca into /etc/named.ca - Fix failures in idna system test (RHEL-66172) - Decode IDN names on input in all situations in utilities (RHEL-66172) - logrotate: skip if empty and remove old variants (RHEL-113942) - Add runtime tunable limit by environment NAMED_MAXADDITIONAL (RHEL-84006) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Add new root key 38696 into package files too (RHEL-252999) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Prevent assertion failure in dns64 mode with break-dnssec yes (CVE-2026-19666) - Prevent memory leak on following HTTPS/SVCB RR (CVE-2026-81563) - Prevent crash on wildcard responses containing both NSEC and NSEC3 proofs (CVE-2026-80274) - Reject oversized negative cached records early (CVE-2026-19667) - Set limit to following HTTPS/SVCB aliases (CVE-2026-81736) - Add new root key 38696 into package files too (RHEL-252999) - Validate NSEC3 signer matches owning zone (CVE-2026-10723) - Reject out-of-zone NSEC next owner names (CVE-2026-13321) - Fix reference-counted dns_slabheaders in cache (CVE-2026-11622) - Fix RRSIG label count validation for wildcard cache poisoning (CVE-2026-11721) - Fix RPZ name-too-long wildcard expansion (CVE-2026-11331) - Fix assertion failure on malformed NSEC/NSEC3 responses (CVE-2026-13204) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-5946) - Prevent Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) - Add forgotten _libdir/named into bind-chroot tmpfiles (RHEL-132053) - Create /var/named directories for bind-chroot (RHEL-132053) - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Refuse malformed DNSKEY records (CVE-2025-8677) - Address various spoofing attacks (CVE-2025-40778) - Prevent cache poisoning due to weak PRNG (CVE-2025-40780) - Move named.* files from /var/named into /usr/share/named - Move named.ca into /etc/named.ca - Fix failures in idna system test (RHEL-66172) - Decode IDN names on input in all situations in utilities (RHEL-66172) - logrotate: skip if empty and remove old variants (RHEL-113942) - Update to 0.72.1 - Initialize gating - Initial commit on c10s - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Analyse bison sources for license information - Migrate License field to SPDX identifiers for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 (#2222079) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Update to 5.85 Resolves: RHEL-142551 - Fix problem with menu handling Resolves: RHEL-103965 - Update to 5.83 - Resolves: RHEL-94817 - Fix startup warnings - Resolves: RHEL-88703 - Add OSCI tests - Resolves: RHEL-77171 - Fix config not being applied - Resolves: RHEL-78405 - Fix wordexp() related crasher - Resolves: RHEL-56021 - Update gating and rpminspect files - Related: Jira:RHEL-76183 - Related: Jira:RHEL-54482 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Add boost-url dependency to metapackage Resolves: RHEL-124169 - Backport patch to fix build of boost thread on Clang19 and later Resolves: RHEL-118607 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - totem-pl-parser won't be in RHEL 10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Dropped ucs-miscfixed-fonts requirement, xorg-x11-fonts-misc is enough Resolves: RHEL-46310 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added SPDX licenses found by ScanCode - Dropped redundant license tags from subpackages - Migrate group creation to sysusers - Bump release and rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52687 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.5.0 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-build-helper - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.5.0 - Update to upstream version 3.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-build-helper - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - C99 compatibility fix - Rebuild to fix main-class attribute of module-info - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52717 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild to fix main-class attribute of module-info - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52717 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild to fix main-class attribute of module-info - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52717 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.18.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.18.0 - Drop the xml surface and cairo-sphinx tool as they've been removed upstream - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix crash due to scaled_glyph->dev_private reuse (#2189228) - Fix missing glyphs in ft-font - Rebuild for new freetype-2.13.0 - Backport an upstream patch to fix printing PDFs - Resolves: RHEL-238394 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.18.2 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.18.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Removed superfluous processing of the OpenPGP key. - Revert "Work around missing dependency on texlive-wasy" - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.18.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use new (rpm 4.17.1+) bcond style - Removed superfluous processing of the OpenPGP key. - Revert "Work around missing dependency on texlive-wasy" - capnproto-1.3.0 (RHEL-127899) - Remove needless test skipping - Rebase to latest capnproto-1.2.0 - Enable gating - Initial commit on c10s - capnproto-1.3.0 (RHEL-127899) - Remove needless test skipping - Rebase to latest capnproto-1.2.0 - Enable gating - Initial commit on c10s - capnproto-1.3.0 (RHEL-127899) - Remove needless test skipping - Rebase to latest capnproto-1.2.0 - Enable gating - Initial commit on c10s - Rebuild for rhel-10.2 - Fix CVE-2025-67873 (heap buffer overflow) Resolves: RHEL-141553 - Fix CVE-2025-68114 (memory corruption) Resolves: RHEL-137749 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Bump release for June 2024 mass rebuild - Rebuild for rhel-10.2 - Fix CVE-2025-67873 (heap buffer overflow) Resolves: RHEL-141553 - Fix CVE-2025-68114 (memory corruption) Resolves: RHEL-137749 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Bump release for June 2024 mass rebuild - Update to 0.29.2 - Initialize gating - Initial commit on c10s - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52687 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52687 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - Bump release for June 2024 mass rebuild - resolves: RHEL-192935 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - resolves: RHEL-247581 - fix krb5 regression with --trust-dns - resolves: RHEL-192935 - fix krb5 mount regression - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego - resolves: RHEL-146310 - Enable debug logs in cifs.upcall - resolves: RHEL-131409 - fix regression with cifscreds(1) - resolves: RHEL-82681 - Update to version 7.2 - Bump release for October 2024 mass rebuild: - resolves: RHEL-61731 - Update to version 7.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add gating tests configuration - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebase to version 0.6.2.2. Solves CVE-2023-37464. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-53938: heap buffer overflow in AES key unwrap Resolves: RHEL-256962 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-276901 - Fix CVE-2026-53938: heap buffer overflow in AES key unwrap Resolves: RHEL-256962 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Backport a patch to fix ProtectSystem=strict - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix mass-rebuild failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides - Rebuild for glib2 symbol export fix (#2232723) - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Backport a patch to fix ProtectSystem=strict - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix mass-rebuild failure - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides - Rebuild for glib2 symbol export fix (#2232723) - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - New upstream version - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to https://github.com/containers/composefs/releases/tag/v1.0.8 - Fix build - Related: RHEL-60292 - composefs-1.0.7-1.el10 - update to https://github.com/containers/composefs/releases/tag/v1.0.7 - Related: RHEL-60292 - Bump release for October 2024 mass rebuild: - update to the latest upstream release https://github.com/containers/composefs/releases/tag/v1.0.6 Related: RHEL-60292 - composefs-1.0.5-1.el10 - update to https://github.com/containers/composefs/releases/tag/v1.0.5 - Related: RHEL-34195 - Update to 1.0.4 - Resolves: RHEL-122945 - New upstream release (RHEL-122945) - Resolves: RHEL-96073 - exec: Add support for env STATE_DIRECTORY - init: Use LogsDirectory in systemd unit file - Resolves: RHEL-84612 - totemsrp: Check size of orf_token msg (fixes CVE-2025-30472) - Resolves: RHEL-65701 - New upstream release (RHEL-65701) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-163802 - Resolves: RHEL-163823 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092) - Resolves: RHEL-122945 - New upstream release (RHEL-122945) - Resolves: RHEL-96073 - exec: Add support for env STATE_DIRECTORY - init: Use LogsDirectory in systemd unit file - Resolves: RHEL-84612 - totemsrp: Check size of orf_token msg (fixes CVE-2025-30472) - Resolves: RHEL-65701 - New upstream release (RHEL-65701) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-251541 - totempg: Replace assert with check in deliver_fn (fixes CVE-2026-81665) - Resolves: RHEL-163802 - Resolves: RHEL-163823 - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091) - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092) - Resolves: RHEL-122945 - New upstream release (RHEL-122945) - Resolves: RHEL-96073 - exec: Add support for env STATE_DIRECTORY - init: Use LogsDirectory in systemd unit file - Resolves: RHEL-84612 - totemsrp: Check size of orf_token msg (fixes CVE-2025-30472) - Resolves: RHEL-65701 - New upstream release (RHEL-65701) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - tests: Remove unused remnants of Beaker - tests: Fix TMT dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport patch to run tests in deterministic order - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - tests: Fix fmf plan deprecated attributes - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - tests: Remove unused remnants of Beaker - tests: Fix TMT dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport patch to run tests in deterministic order - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - tests: Fix fmf plan deprecated attributes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add missing man page for create-cracklib-dict (RHEL-39972) - Preserve special characters in cracklib-format (RHEL-39972) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2123955 cracklib-2.9.11 is available - Remove old patches, port remaining patches to 2.9.11 - Use man pages from doc/ instead of pulling them from debian - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Debrand for AlmaLinux - Rebase to upstream crash 9.0.1 - Rebase to upstream crash 62486400d35 - Rebase to upstream crash 2c69f93e59c - Rebase to upstream crash 7e8a2796580 - Rebase to upstream crash 9.0.0 - Rebase to upstream crash 8.0.6 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to upstream crash 8.0.5 f615f8fab7bf3 - Rebase to upstream crash 8.0.5 ce4ddc742fbdd - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix a file descriptor and a memory leak in an error path of cr_detect_compression() (RHEL-45645) - Bump release for June 2024 mass rebuild - 1.1.2 bump (RHEL-38831) - 1.1.1 bump (RHEL-38831) - Package Python examples - Update to 1.0.4 (RHEL-38831) - Extend the --compatibility flag to cover other defaults - mergerepo_c and modifyrepo_c now make "pretty" indented xml - Fix building due to bash-completion repackaging - Update to 1.0.3 - Set compression level 10 for zstd and zck - Introduce new --no-pretty option to reduce metadata size - Use gzip compression by default when --compatibility is specified - Default changelog limit restored for --compatibility - Use epoch-friendly sub-package interdependencies - Enable sqlite shared cache on connection level - Fix const-correctness with libxml2-2.12.0 - Allow specifying zck compression only - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Restore compatiblity with libxml2-2.12.0 - Update to 4.2 - Update to 4.1 - Fix VDSO compile error on s390x - Adapt patches to patches merged upstream - Fix running on aarch64 - Switch network locking backend default to nftables - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix test setup - Add riscv64 to ExclusiveArch - Handle rseq in generic compel code (checkpoint-restore/criu#3097) - Update to 4.2 - Update to 4.1 - Fix VDSO compile error on s390x - Adapt patches to patches merged upstream - Fix running on aarch64 - Switch network locking backend default to nftables - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - patch: opal: Submit PSID reset command to R/W file descriptor. - patch: Read integrity profile info from top level device. - patch: Fix possible use of uninitialized variable. - patch: Reinstate pbkdf serialization flag in device activation. - patch: Fix LUKS2 device status in inline HW mode and detached header. - patch: Set inline integrity flag if no underlying dm-integrity device. - patch: Fix wrong device size status reports in cryptsetup and integritysetup. - Resolves: RHEL-122285 RHEL-125150 RHEL-125155 RHEL-125166 RHEL-132584 RHEL-140107 - Update to cryptsetup 2.8.1 - Resolves: RHEL-96291 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to cryptsetup 2.7.5 - patch: Warn if Argon2 keyslot is unlocked in FIPS mode. - patch: Enable Argon2 in FIPS with openssl backend. - Resolves: RHEL-57036 RHEL-57037 RHEL-61581 - Bump release for June 2024 mass rebuild - Update to cryptsetup 2.7.3 - Remove libssh dependency - Resolves: RHEL-40123 - Remove SSH token and fix tests - Resolves: RHEL-33395 - Update to cryptsetup 2.7.2 - Resolves: RHEL-33395 - Rebuild for OpenSSL Argon2 implementation (OpenSSL 3.2) - patch: Do not compile unused internal argon2 implementation - Update to cryptsetup 2.7.0. - bump release for rebuild to re-run tests. - Related: RHEL-99217 - Rebase to upstream v82 - Resolves: RHEL-99217 - Fix listing of region capabilities (Jeff Moyer) - Remove orphaned patch file (Jeff Moyer) - Resolves: RHEL-80436 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Declare explicit version dependencies for daxctl, cxl-cli and cxl-libs. - Related: RHEL-33029 - Update to upstream v80. - Resolves: RHEL-33029 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix Py 3.12 imports (rhbz#2220636) - Rebuilt for Python 3.12 - Remove obsolete texlive-collection-htmlxml dependency - Adjust patch macro usage to rpm >= 4.18 in a cleaner way - Fix deprecated patch rpm macro - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.10 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.14.8 - Update to 1.14.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Describe DBDIR argument in man page - Resolves: RHEL-83392 - Backport patch for permissions restore - Indicate bundle of GVDB - Resolves: RHEL-71949 - Do not use system profile for tests - Resolves: RHEL-65653 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Additional fixes up to 2.03.38. - Update to upstream version 2.03.36. - See WHATS_NEW and WHATS_NEW_DM for more information. - Update to upstream version 2.03.35. - See WHATS_NEW and WHATS_NEW_DM for more information. - Respin. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Add libnvme dependency to really fix the NVMe issue. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Additional fixes up to 2.03.38. - Update to upstream version 2.03.36. - See WHATS_NEW and WHATS_NEW_DM for more information. - Update to upstream version 2.03.35. - See WHATS_NEW and WHATS_NEW_DM for more information. - Respin. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Add libnvme dependency to really fix the NVMe issue. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Add 0085-libmpathpersist-fix-register-retry-status-checking.patch - Add 0086-multipathd-remember-number-of-registered-keys-when-i.patch - Add 0087-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch * Fixes RHEL-129442 ("Improve multipathd's handling of updating persistent reservations on restored paths.") - Resolves: RHEL-129442 - Add 0083-libmultipath-add-purge_disconnected-configuration-op.patch - Add 0084-multipathd-implement-purge-functionality-for-disconn.patch * Fixes RHEL-141287 ("Add purge_disconnected support to multipathd") - Resolves: RHEL-141287 - Add 0081-multipathd-make-multipathd-show-status-busy-checker-.patch * Fixes RHEL-136405 ("improve Busy checking for multipathd show status output") - Add 0082-multipathd-print-path-offline-message-even-without-a.patch * Fixes RHEL-133815 ("log_checker_err is not printing messages repeatedly for failed path [rhel-10]") - Resolves: RHEL-133815 - Resolves: RHEL-136405 - Add 0080-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch * Fixes RHEL-128338 ("Update the multipath.conf stanza for Infinidat storage") - Resolves: RHEL-128338 - Add 0078-multipathd-Fix-race-while-registering-PR-key.patch - Add 0079-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 - Add 0035-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch - Add 0036-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch - Add 0037-libmpathpersist-check-released-key-against-the-reser.patch - Add 0038-multipathd-remove-thread-from-mpath_pr_event_handle.patch - Add 0039-libmpathpersist-remove-uneeded-wrapper-function.patch - Add 0040-libmpathpersist-reduce-log-level-for-persistent-rese.patch - Add 0041-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch - Add 0042-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch - Add 0043-libmpathpersist-limit-changing-prflag-in-update_map_.patch - Add 0044-multipathd-Don-t-call-update_map_pr-unnecessarily.patch - Add 0045-libmpathpersist-remove-useless-function-send_prout_a.patch - Add 0046-libmpathpersist-redesign-failed-release-workaround.patch - Add 0047-libmpathpersist-fail-the-release-if-all-threads-fail.patch - Add 0048-libmpathpersist-Handle-changing-key-corner-case.patch - Add 0049-libmpathpersist-Handle-REGISTER-AND-IGNORE-changing-.patch - Add 0050-libmultipath-rename-prflag_value-enums.patch - Add 0051-libmpathpersist-use-a-switch-statement-for-prout-com.patch - Add 0052-libmpathpersist-Add-safety-check-for-preempting-on-k.patch - Add 0053-libmpathpersist-remove-update_map_pr-code-for-NULL-p.patch - Add 0054-libmpathpersist-move-update_map_pr-to-multipathd.patch - Add 0055-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch - Add 0056-libmpathpersist-clean-up-duplicate-function-declarat.patch - Add 0057-multipathd-wrap-setting-and-unsetting-prflag.patch - Add 0058-multipathd-unregister-PR-key-when-path-is-restored-i.patch - Add 0059-libmpathpersist-Fix-up-reservation_key-checking.patch - Add 0060-libmpathpersist-change-how-reservation-conflicts-are.patch - Add 0061-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch - Add 0062-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch - Add 0063-libmpathpersist-Restore-old-reservation-key-on-failu.patch - Add 0064-libmpathpersist-update-reservation-key-before-checki.patch - Add 0065-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch - Add 0066-libmpathpersist-Don-t-always-fail-registrations-for-.patch - Add 0067-libmpathpersist-Don-t-try-release-workaround-for-inv.patch - Add 0068-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch - Add 0069-libmpathpersist-reregister-keys-when-self-preempting.patch - Add 0070-libmpathpersist-handle-updating-key-race-condition.patch - Add 0071-libmpathpersist-handle-preempting-all-registrants-re.patch - Add 0072-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch - Add 0073-libmpathpersist-Handle-RESERVE-with-reservation-held.patch - Add 0074-libmpathpersist-use-check_holding_reservation-in-mpa.patch - Add 0075-libmpathpersist-Fix-unregistering-while-holding-the-.patch - Add 0076-libmpathpersist-Fix-race-between-restoring-a-path-an.patch - Add 0077-multipathd-Fix-tracking-of-old-PR-key.patch * Fixes RHEL-118720 ("There are many bugs in multipath's persistent reservation handling [rhel-10]") - Resolves: RHEL-118720 Add 0034-libmultipath-fix-crash-in-print_foreign_topology.patch * Fixes RHEL-107436 ("Running multipath -ll on system with "enable_foreign nvme" results in segfault") Resolves: RHEL-107436 - Add 0033-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch * Fixes RHEL-103112 ("Update multipath builtin config to add new device defaults [rhel-10]") - Resolves: RHEL-103112 - Migrate gating tests from STI to tmt - Related: RHEL-82535 - Add 0030-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch - Add 0031-libmultipath-add-helper-function-check_path_wwid_cha.patch - Add 0032-multipathd-re-add-paths-skipped-because-they-were-of.patch * Fixes RHEL-82535 ("multipathd does not monitor multipath devices created externally while there are offline paths.") - Resolves: RHEL-82535 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix SPDX license tag based on further research - https://gitlab.com/fedora/legal/fedora-license-data/-/issues/396#note_1976038980 - Related: RHEL-37885 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Change license tag to SPDX license - Resolves: RHEL-37893 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove unlicensed perl script and howto docs - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Build for the SPDX license format change - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.102 and Runtime 10.0.2 - Resolves: RHEL-138641 - Update to .NET SDK 10.0.101 and Runtime 10.0.1 - Resolves: RHEL-130939 - Update to .NET SDK 10.0.100 and Runtime 10.0.0 - Resolves: RHEL-125749 - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107 - Resolves: RHEL-121558 - Disable bootstrap - Related: RHEL-114571 - Update to .NET 10 RC 1 - Resolves: RHEL-114571 - Disable bootstrap - Related: RHEL-98678 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.102 and Runtime 10.0.2 - Resolves: RHEL-138641 - Update to .NET SDK 10.0.101 and Runtime 10.0.1 - Resolves: RHEL-130939 - Update to .NET SDK 10.0.100 and Runtime 10.0.0 - Resolves: RHEL-125749 - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107 - Resolves: RHEL-121558 - Disable bootstrap - Related: RHEL-114571 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.102 and Runtime 10.0.2 - Resolves: RHEL-138641 - Update to .NET SDK 10.0.101 and Runtime 10.0.1 - Resolves: RHEL-130939 - Update to .NET SDK 10.0.100 and Runtime 10.0.0 - Resolves: RHEL-125749 - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107 - Resolves: RHEL-121558 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 - Reduce time to detect hanging builds - Resolves: RHEL-191640 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.102 and Runtime 10.0.2 - Resolves: RHEL-138641 - Update to .NET SDK 10.0.101 and Runtime 10.0.1 - Resolves: RHEL-130939 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 - Reduce time to detect hanging builds - Resolves: RHEL-191640 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.102 and Runtime 10.0.2 - Resolves: RHEL-138641 - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252320 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 - Reduce time to detect hanging builds - Resolves: RHEL-191640 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 10.0.103 and Runtime 10.0.3 - Resolves: RHEL-144975 - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277809 - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252320 - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 - Reduce time to detect hanging builds - Resolves: RHEL-191640 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 - Adjust build limits - Resolves: RHEL-169518 - Update to .NET SDK 10.0.106 and Runtime 10.0.6 - Resolves: RHEL-163387 - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152955 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.122 and Runtime 8.0.22 - Resolves: RHEL-125739 - Update to .NET SDK 8.0.121 and Runtime 8.0.21 - Resolves: RHEL-116869 - Update to .NET SDK 8.0.120 and Runtime 8.0.20 - Resolves: RHEL-112262 - Update to .NET SDK 8.0.119 and Runtime 8.0.19 - Resolves: RHEL-106721 - Update to .NET SDK 8.0.118 and Runtime 8.0.18 - Resolves: RHEL-100594 - Update to .NET SDK 8.0.117 and Runtime 8.0.17 - Resolves: RHEL-94416 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.122 and Runtime 8.0.22 - Resolves: RHEL-125739 - Update to .NET SDK 8.0.121 and Runtime 8.0.21 - Resolves: RHEL-116869 - Update to .NET SDK 8.0.120 and Runtime 8.0.20 - Resolves: RHEL-112262 - Update to .NET SDK 8.0.119 and Runtime 8.0.19 - Resolves: RHEL-106721 - Update to .NET SDK 8.0.118 and Runtime 8.0.18 - Resolves: RHEL-100594 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.122 and Runtime 8.0.22 - Resolves: RHEL-125739 - Update to .NET SDK 8.0.121 and Runtime 8.0.21 - Resolves: RHEL-116869 - Update to .NET SDK 8.0.120 and Runtime 8.0.20 - Resolves: RHEL-112262 - Update to .NET SDK 8.0.119 and Runtime 8.0.19 - Resolves: RHEL-106721 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 - Reduce time to detect hanging builds - Resolves: RHEL-191650 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.122 and Runtime 8.0.22 - Resolves: RHEL-125739 - Update to .NET SDK 8.0.121 and Runtime 8.0.21 - Resolves: RHEL-116869 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235472 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 - Reduce time to detect hanging builds - Resolves: RHEL-191650 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.122 and Runtime 8.0.22 - Resolves: RHEL-125739 - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252248 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235472 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 - Reduce time to detect hanging builds - Resolves: RHEL-191650 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 8.0.123 and Runtime 8.0.23 - Resolves: RHEL-138653 - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277794 - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252248 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235472 - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 - Reduce time to detect hanging builds - Resolves: RHEL-191650 - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924 - Update to .NET SDK 8.0.126 and Runtime 8.0.26 - Resolves: RHEL-163419 - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152933 - Update to .NET SDK 8.0.124 and Runtime 8.0.24 - Resolves: RHEL-144967 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.112 and Runtime 9.0.11 - Resolves: RHEL-125744 - Update to .NET SDK 9.0.111 and Runtime 9.0.10 - Resolves: RHEL-116861 - Update to .NET SDK 9.0.110 and Runtime 9.0.9 - Resolves: RHEL-112268 - Update to .NET SDK 9.0.109 and Runtime 9.0.8 - Resolves: RHEL-106727 - Update to .NET SDK 9.0.108 and Runtime 9.0.7 - Resolves: RHEL-100597 - Update to .NET SDK 9.0.107 and Runtime 9.0.6 - Resolves: RHEL-94423 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.112 and Runtime 9.0.11 - Resolves: RHEL-125744 - Update to .NET SDK 9.0.111 and Runtime 9.0.10 - Resolves: RHEL-116861 - Update to .NET SDK 9.0.110 and Runtime 9.0.9 - Resolves: RHEL-112268 - Update to .NET SDK 9.0.109 and Runtime 9.0.8 - Resolves: RHEL-106727 - Update to .NET SDK 9.0.108 and Runtime 9.0.7 - Resolves: RHEL-100597 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.112 and Runtime 9.0.11 - Resolves: RHEL-125744 - Update to .NET SDK 9.0.111 and Runtime 9.0.10 - Resolves: RHEL-116861 - Update to .NET SDK 9.0.110 and Runtime 9.0.9 - Resolves: RHEL-112268 - Update to .NET SDK 9.0.109 and Runtime 9.0.8 - Resolves: RHEL-106727 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 - Reduce time to detect hanging builds - Resolves: RHEL-191644 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.112 and Runtime 9.0.11 - Resolves: RHEL-125744 - Update to .NET SDK 9.0.111 and Runtime 9.0.10 - Resolves: RHEL-116861 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235477 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 - Reduce time to detect hanging builds - Resolves: RHEL-191644 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.112 and Runtime 9.0.11 - Resolves: RHEL-125744 - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252279 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235477 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 - Reduce time to detect hanging builds - Resolves: RHEL-191644 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - Update to .NET SDK 9.0.113 and Runtime 9.0.12 - Resolves: RHEL-138646 - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277801 - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252279 - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235477 - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 - Reduce time to detect hanging builds - Resolves: RHEL-191644 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919 - Update to .NET SDK 9.0.116 and Runtime 9.0.15 - Resolves: RHEL-163400 - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152947 - Update to .NET SDK 9.0.114 and Runtime 9.0.13 - Resolves: RHEL-144971 - fix CVE-2026-42006: fix imap_parser list_count_limit to actually work (RHEL-188477) - update release for rebuild - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161626) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162274) - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161665) - fix building with latest openssl (RHEL-117460) - add /var/lib/dovecot to tmpfiles for image mode (RHEL-130953) - fix sysusers config file name (RHEL-77323) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55218) - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55205) - fix crash when user has sieve script that includes two missing scripts (RHEL-52541) - fix building with noengine openssl - fix CVE-2026-33605: ManageSieve: denial of service via lone CR character causing protocol deadlock (RHEL-251984) - fix CVE-2026-42007: fix use-after-free and info leak in sieve editheader extension (RHEL-251945) - fix CVE-2026-40018: incorrect escaping of multi-byte strings in SQL commands (RHEL-252058) - fix CVE-2026-42391: fix excessive memory growth with pre-login ID command (RHEL-252072) - fix CVE-2026-73208: OAuth2 scope check requires all configured scopes, add oauth2_audience setting (RHEL-251900) - fix CVE-2026-27852: limit parsed message data to prevent memory exhaustion (RHEL-251564) - fix CVE-2026-33263: submission-login epoll panic at mail_max_userip_connections limit (RHEL-251917) - fix CVE-2026-42006: fix imap_parser list_count_limit to actually work (RHEL-188477) - update release for rebuild - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161626) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162274) - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161665) - update release for rebuild - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161626) - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162274) - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161665) - fix building with latest openssl (RHEL-117460) - add /var/lib/dovecot to tmpfiles for image mode (RHEL-130953) - fix sysusers config file name (RHEL-77323) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-23185: very large headers can cause resource exhaustion when parsing message (RHEL-55218) - fix CVE-2024-23184: using a large number of address headers may trigger a denial of service (RHEL-55205) - fix crash when user has sieve script that includes two missing scripts (RHEL-52541) - fix building with noengine openssl - Bump release for June 2024 mass rebuild - set min uid to 1000 - Resolves: RHEL-73868, update to 1.13.2 - Fix Non-reproducible file names in doxygen output - Fix broken markdown links to anchors Related: RHEL-58045 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-58045, update doxygen to 1.12.0 - Bump release for June 2024 mass rebuild - Resolves: RHEL-40092, update doxygen to 1.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - don't use clang to build doxygen as workaround for a bug in gcc-14 - bz#2255826, update to 1.10 - fix bz#2235035, update to 1.9.8 - Resolves: RHEL-73868, update to 1.13.2 - Fix Non-reproducible file names in doxygen output - Fix broken markdown links to anchors Related: RHEL-58045 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-58045, update doxygen to 1.12.0 - Bump release for June 2024 mass rebuild - Resolves: RHEL-40092, update doxygen to 1.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - don't use clang to build doxygen as workaround for a bug in gcc-14 - bz#2255826, update to 1.10 - fix bz#2235035, update to 1.9.8 - Rebased to dyninst 13.0.0 + buildability patches - Dropping testsuite - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for Boost 1.83 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - side-tag respin - migrated to SPDX license - Update to 12.3.0 - Add patch for cmake 3.27 support - Rebased to dyninst 13.0.0 + buildability patches - Dropping testsuite - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for Boost 1.83 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - side-tag respin - migrated to SPDX license - Update to 12.3.0 - Add patch for cmake 3.27 support - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 0.12.9 - Update to 0.12.8 (close RHBZ#2292212) - Update to 0.12.7 (close RHBZ#2272370) - Use bundled uthash in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.12.6 (close RHBZ#2162811) - Update License to SPDX - Document and/or unbundle all bundled libraries - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 0.12.9 - Update to 0.12.8 (close RHBZ#2292212) - Update to 0.12.7 (close RHBZ#2272370) - Use bundled uthash in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.12.6 (close RHBZ#2162811) - Update License to SPDX - Document and/or unbundle all bundled libraries - Pin the X64 firmware ISA baseline to x86-64-v2 - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - Rebase to edk2-stable202508 [RHEL-111718] - Resolves: RHEL-111718 ([edk2,rhel-10] rebase to edk2-stable202508) - edk2-add-qemu-vars-builds-to-build-config-and-file-lists.patch [RHEL-2908] - edk2-add-dbx-update-script.patch [RHEL-96866] - edk2-update-dbx-to-20250610.patch [RHEL-96866] - Resolves: RHEL-2908 ([aarch64][EDK2] UEFI writable variable service in QEMU) - Resolves: RHEL-96866 ([edk2,rhel-10] dbx update 20250610) - Pin the X64 firmware ISA baseline to x86-64-v2 - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - Rebase to edk2-stable202508 [RHEL-111718] - Resolves: RHEL-111718 ([edk2,rhel-10] rebase to edk2-stable202508) - edk2-add-qemu-vars-builds-to-build-config-and-file-lists.patch [RHEL-2908] - edk2-add-dbx-update-script.patch [RHEL-96866] - edk2-update-dbx-to-20250610.patch [RHEL-96866] - Resolves: RHEL-2908 ([aarch64][EDK2] UEFI writable variable service in QEMU) - Resolves: RHEL-96866 ([edk2,rhel-10] dbx update 20250610) - Pin the X64 firmware ISA baseline to x86-64-v2 - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/x64: re-enable legacy kernel loader [rhel-10.2.z]) - Resolves: RHEL-165699 (CVE-2026-28390 edk2: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing [rhel-10.2]) - edk2-Bumped-to-OpenSSL-3.5.5-2.patch [RHEL-161573] - Resolves: RHEL-161573 (CVE-2026-31790 edk2: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key [rhel-10.2]) - edk2-add-uefi-vars-firmware-json-files.patch [RHEL-150696] - Resolves: RHEL-150696 (edk2: Add JSON descriptors for uefi-vars builds) - edk2-OvmfPkg-X86QemuLoadImageLib-flip-default-for-EnableL.patch [RHEL-134956] - edk2-update-openssl-rhel-submodule.patch [RHEL-147785] - edk2-update-openssl-rhel-tarball.patch [RHEL-147785] - Resolves: RHEL-134956 (CVE-2025-2296 edk2: EDK2: Improper Input Validation allows arbitrary command execution [rhel-10.2]) - Resolves: RHEL-147785 ([edk2] pick up openssl updates) - edk2-OvmfPkg-AmdSev-add-memory-debug-log-support.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiLib-drop-duplicate-MemDebugLog.patch [RHEL-139470] - edk2-OvmfPkg-MemDebugLogPeiCoreLib-enable-for-PEIMs.patch [RHEL-139470] - edk2-ArmVirtPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - edk2-OvmfPkg-use-MemDebugLogPeiCoreLib-for-PEIMs.patch [RHEL-139470] - Resolves: RHEL-139470 (Enable memory debug logging support in firmware image configs) - edk2-ArmPkg-UefiCpuPkg-Fix-boot-failure-on-FEAT_LPA-only-.patch [RHEL-138335] - Resolves: RHEL-138335 ([AmpereoneX] ArmConfigureMmu: The MaxAddress 0xFFFFFFFFFFFFF is not supported by this MMU configuration) - Rebase to edk2-stable202511 [RHEL-118386] - Resolves: RHEL-118386 ([edk2,rhel-10] rebase to edk2-stable202511) - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126085] - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126085] - Resolves: RHEL-126085 ([edk2,rhel-10] dbx update to 20251016 / v1.6.1) - edk2-Bumped-OpenSSL-to-3.5.1-6.patch [RHEL-115880] - Resolves: RHEL-115880 (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-10.2]) - edk2-add-DBXUpdate-20250610.aa64.bin.patch [RHEL-109548] - Resolves: RHEL-109548 ([aarch64][edk2] missing DBXUpdate-${date}.aa64.bin) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild with suitesparse 7.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop unused glew build dependency - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Avoid extra test dependencies in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.6.9 Resolves: RHEL-32770 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 2.6.7 - Rebuild (icu) - Update to 2.6.6 - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.6.5 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fixed buffer overflow in SetUpPhonemeTable function at synthdata.c Resolves: CVE-2023-49990 - Fixed buffer underflow in CountVowelPosition function at synthdata.c Resolves: CVE-2023-49991 - Fixed buffer overflow in RemoveEnding at dictionary.c Resolves: CVE-2023-49992 - Fixed buffer overflow in ReadClause function at readclause.c Resolves: CVE-2023-49993 - Fixed floating point exception in PeaksToHarmspect at wavegen.c Resolves: CVE-2023-49994 - Change license tag so it fully conforms to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-77352 (EBackend: Change when adding signal handler for "network-changed") - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-52806 (Update to 3.52.4) - Resolves: RHEL-45599 (Update to 3.52.3) - Bump release for June 2024 mass rebuild - Resolves: RHEL-38639 (Update to 3.52.2) - Resolves: RHEL-33592 (Backport Fedora 40 changes) - Update to 3.52.1 - Resolves: RHEL-30204 (Backport Fedora 40 changes) - Update to 3.52.0 - Add patch to allow reconfiguring the dbus-prefix without rebuilding; this is needed to make EDS work with the new Flatpak infrastructure. - Remove support _eds_dbus_services_prefix - this was only used by F38 and earlier Flatpak builds. - Update to 3.51.2 - Rebuild for ICU 74 - Resolves: RHEL-77352 (EBackend: Change when adding signal handler for "network-changed") - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-52806 (Update to 3.52.4) - Resolves: RHEL-45599 (Update to 3.52.3) - Bump release for June 2024 mass rebuild - Resolves: RHEL-38639 (Update to 3.52.2) - Resolves: RHEL-33592 (Backport Fedora 40 changes) - Update to 3.52.1 - Resolves: RHEL-30204 (Backport Fedora 40 changes) - Update to 3.52.0 - Add patch to allow reconfiguring the dbus-prefix without rebuilding; this is needed to make EDS work with the new Flatpak infrastructure. - Remove support _eds_dbus_services_prefix - this was only used by F38 and earlier Flatpak builds. - Update to 3.51.2 - Rebuild for ICU 74 - Resolves: RHEL-77352 (EBackend: Change when adding signal handler for "network-changed") - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-52806 (Update to 3.52.4) - Resolves: RHEL-45599 (Update to 3.52.3) - Bump release for June 2024 mass rebuild - Resolves: RHEL-38639 (Update to 3.52.2) - Resolves: RHEL-33592 (Backport Fedora 40 changes) - Update to 3.52.1 - Resolves: RHEL-30204 (Backport Fedora 40 changes) - Update to 3.52.0 - Add patch to allow reconfiguring the dbus-prefix without rebuilding; this is needed to make EDS work with the new Flatpak infrastructure. - Remove support _eds_dbus_services_prefix - this was only used by F38 and earlier Flatpak builds. - Update to 3.51.2 - Rebuild for ICU 74 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild - Synchronize with Fedora version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild - Synchronize with Fedora version - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Setup gating for c10s - Add riscv64 support. - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Avoid implicit function declarations in configure (#2144890) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.6.4 Resolves #2221013 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to version 2.6.3 Resolves #2152330 - Revert: remove rpath patch Resolves: RHEL-80106 - Fix CVE-2025-26623 exiv2: Use After Free Resolves: RHEL-80106 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Backport RHEL9 patch for RPATH Resolves: RHEL-45267 - 0.28.3 Resolves: RHEL-45267 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Revert: remove rpath patch Resolves: RHEL-80106 - Fix CVE-2025-26623 exiv2: Use After Free Resolves: RHEL-80106 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Backport RHEL9 patch for RPATH Resolves: RHEL-45267 - 0.28.3 Resolves: RHEL-45267 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream release 2.3.1 - Update to upstream release 2.1.0 - Update to upstream release 1.22.0 - Bump release for October 2024 mass rebuild: - Adding files for c10s gating test - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 8 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52688 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52688 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Disable openmpi for i686 architecture - Enable openmpi for RHEL - Resolves: RHEL-65277 - Re-enable openmpi for s390x - Resolves: RHEL-65277 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix i686 build by disabling openmpi - Fix "The file FFTW3LibraryDepends.cmake is missing" in autotools build https://github.com/FFTW/fftw3/issues/130#issuecomment-1902748460 (#2193075) - Disable mpich on s390x to fix the build - Fix TypeError: 'NoneType' object is not callable in magic.close() Resolves: RHEL-151423 - magic: Use the bcachefs-uuid for erofs Resolves: RHEL-76142 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 1.4.3 - convert license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 1.4.3 - convert license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Backport: Enable collection IDs for OCI remotes Resolves: RHEL-72779 - Rebase backported upstream patches to updated versions Resolves: RHEL-26066 - Update to 1.16.0 Resolves: RHEL-72779 - Add support for preinstalling Flatpaks Resolves: RHEL-26066 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157 - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Backport: Enable collection IDs for OCI remotes Resolves: RHEL-72779 - Rebase backported upstream patches to updated versions Resolves: RHEL-26066 - Update to 1.16.0 Resolves: RHEL-72779 - Add support for preinstalling Flatpaks Resolves: RHEL-26066 - Avoid symlink path traversal in revokefs writer (CVE-2026-96808) Resolves: RHEL-267891 - Prevent arbitrary write as root via extra-data extraction (CVE-2026-96275) Resolves: RHEL-267432 - Use gsize for OCI delta sizes and harden delta parser (CVE-2026-96280) Resolves: RHEL-271519 - Align backport with the other branches Resolves: RHEL-258970 - Harden data dir and var setup against symlink attacks Resolves: RHEL-258970 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157 - kill: Do not kill pid 0 and embrace races Resolves: RHEL-140924 - Enable FIPS crypto policy if it is enabled on the host Resolves: RHEL-77484 - Get certificates from /etc/pki/entitlement for registry.redhat.io Resolves: RHEL-85004 - Fix wrongly marked failed installs as pre-installed Resolves: RHEL-89989 - Fix crash and installatcion of OCI images Resolves: RHEL-76958 - Rebuild with selinux-policy-40.13.23-1 Resolves: RHEL-36741 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 rhel10: set an appropriate value for %{distcore} - Bump release for June 2024 mass rebuild - Define pandoc_datadir - Override jurand macros - Version bump for F40 - Define JAVA_HOME, JAVACONFDIRS and %__maven_path - Change xmvn configuration location - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Define %_localstatedir and %__git - Fix %dist tag to be consistent with fedora-release - Fix release date and version in the AppStream data Resolves: RHEL-121458 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Adapt to centos-stream and RHEL for el10 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Obsolete the fontawesome-fonts package (bz 2239785) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Move fonts back to /usr/share/fonts/fontawesome - Name change to fontawesome4-fonts - Convert License tags to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt to make web subpackage available in AppStream Resolves: RHEL-190850 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix a memory leak and potentially uninitialized values. Resolves: RHEL-41007, RHEL-41008 - Bump release for June 2024 mass rebuild - Delete .uuid with fc-cache -f. Resolves: rhbz#1761885 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release. Resolves: rhbz#2255623 - Update 65-nonlatin.conf to 69-nonlatin.conf This basically provides substitutes for certain languages and is helpful to determine default behavior though, we have per-package config for similar purpose. Since 65 is mostly used for default fonts and this config prevents some behavior for packages named something coming later than "nonlatin" in the alphabetical order. So moving this to the safer priority. This would fixes an issue, particularly Lohit Marathi vs Lohit Devanagari after updating their priorities from 65 to 66. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Drop 10-sub-pixel-rgb-for-kde.conf Resolves: rhbz#2212512 - Resolves: RHEL-138134 CVE-2025-15270 SFD File Parsing Remote Code Execution Vulnerability - Resolves: RHEL-138159 CVE-2025-15279 GUtils BMP File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138144 CVE-2025-15275 SFD File Parsing Heap-based Buffer Overflow - Resolves: RHEL-138126 CVE-2025-15269 SFD File Parsing Use-After-Free - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-31498 various flaws CVE-2024-25081 and CVE-2024-25082 - Add gating.yaml file - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add exact binary name in the file list. - Do not package backup files. Resolves: RHEL-54049 - Add %{epoch} in Requires line if needed - Support fontpkgheader macro for meta packages. - Drop YAML support in gen-fontconf for RHEL10 or later. - Update to 1.6.17 - .fmf/version: Add fmf metadtata root - gating: RHEL-10: Add OSCI testing - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - Update to 1.6.18 - Update to 1.6.17 - .fmf/version: Add fmf metadtata root - gating: RHEL-10: Add OSCI testing - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Disable JIT if PCRE can't allocate executable memory - Fix warnings from service file Resolves: RHEL-116594 - Rebase to release 3.2.8 Resolves: RHEL-107671 - Rebuild for OpenSSL 3.5 Resolves: RHEL-88054 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Disable unsupported Perl script - Rebase to release 3.2.5 Resolves: RHEL-46784 - Bump release for June 2024 mass rebuild - Remove SQL helper script from package Resolves: RHEL-31745 - Remove Antora docs from package Resolves: RHEL-31184 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947, CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-253892, RHEL-260716, RHEL-260750, RHEL-260763, RHEL-260778 Resolves: RHEL-260794, RHEL-260807, RHEL-260842, RHEL-260856, RHEL-260891 Resolves: RHEL-260912 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Try next DNS entry on connect failure Resolves: RHEL-140099 - Fix broken SSL checks and disable runtime checks (RHEL-73724) - Silence abidiff - Resolves: RHEL-86251 - Limit threadpool to 16 threads - Resolves: RHEL-86251 - Initialize function pointers after resource allocation - Fixes CVE-2025-4478 - Resolves: RHEL-91583 - Update to 3.10.3 - Update to 3.9.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.8.0 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947, CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-253892, RHEL-260716, RHEL-260750, RHEL-260763, RHEL-260778 Resolves: RHEL-260794, RHEL-260807, RHEL-260842, RHEL-260856, RHEL-260891 Resolves: RHEL-260912 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Try next DNS entry on connect failure Resolves: RHEL-140099 - Fix broken SSL checks and disable runtime checks (RHEL-73724) - Silence abidiff - Resolves: RHEL-86251 - Limit threadpool to 16 threads - Resolves: RHEL-86251 - Initialize function pointers after resource allocation - Fixes CVE-2025-4478 - Resolves: RHEL-91583 - Update to 3.10.3 - Update to 3.9.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.8.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix SAST Automation findings - Resolves: RHEL-44737 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Remove a patch which causes FTBFS - Resolves: #2261113 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.13.2 - Resolves: #2217137 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.13.1 - Resolves: #2217137 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Expand licenses to SPDX identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Expand licenses to SPDX identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump relaese to have a proper build - Related: RHEL-69027 - Fix the release section of name - Related: RHEL-69027 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Build to test gating - Related: RHELMISC-3921 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release - Use the accidentally-dropped efi_os_dir - Ensure valgrind is disabled on arches without valgrind - Rebase to latest upstream version - Sync the content of main.fmf from rhel9 to rhel10 - Rebase to latest upstream version - Rebase to latest upstream version. - Set efi_os_dir to 'redhat', rather than using 'rhel' - Bump release for October 2024 mass rebuild: - Rebase to get hardware support for CERTPX-13842 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Explicitly BR pkgconfig(systemd); fixes RHBZ#2142295 - Rebuilt for Python 3.14 - Fix *.py scripts packaging - Update to 3.10.3 - Enable blosc - Rebuild (poppler) - Add definitions of missing int16_t and int32_t - Rebuild for libarrow 19 in poppler's sidetag - Update to 3.10.2 - Rebuilt for libarrow 19 - Rebuild (poppler) - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Resolves: RHEL-79677 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Address issues from static analysis - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Add starting headless sessions with C tool - Quit plymouth when no local display is available - Fix launching headless service on boot - Fix gdm-x-session parameter, now it uses "--handle-registration" - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Add starting headless sessions with C tool - Fix auth bypass in authselect pam substacks - Fix gdm-x-session parameter, now it uses "--handle-registration" - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Fix crash in session-settings related with ActUser - Update unified authentication patch to drop passkey/web auth settings - Fix auth bypass in authselect pam substacks - Resolves: https://redhat.atlassian.net/browse/RHEL-178665 - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Add starting headless sessions with C tool - Quit plymouth when no local display is available - Fix launching headless service on boot - Fix gdm-x-session parameter, now it uses "--handle-registration" - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Add starting headless sessions with C tool - Fix auth bypass in authselect pam substacks - Fix gdm-x-session parameter, now it uses "--handle-registration" - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Fix recording wtmp/utmp/btmp - Improve plymouth handling - Fix crash in session-settings related with ActUser - Update unified authentication patch to drop passkey/web auth settings - Fix auth bypass in authselect pam substacks - Resolves: https://redhat.atlassian.net/browse/RHEL-178665 - Update how GDM handles Registering session/display to properly - Check for "boot_vga" when creating the display - Fix reporting false failed authentication - Update debug_json_requests with extra optimization - Backport GDM passwordless feature - Keep register display method - Update to 2.7.2 + Backport fixes from upstream to use BeaconDB + Use BeaconDB for the default location services source Resolves: RHEL-79063 - Resolves: RHEL-44940 (Remove Mozilla Location Service) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format). - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.7.0 - Switch to libsoup 3 - Update to 2.7.2 + Backport fixes from upstream to use BeaconDB + Use BeaconDB for the default location services source Resolves: RHEL-79063 - Resolves: RHEL-44940 (Remove Mozilla Location Service) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Provide a sysusers.d file to get user() and group() provides (see https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format). - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.7.0 - Switch to libsoup 3 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - enable gating - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license - Add provides for geocode-glib2 - Rename geocode-glib2 back to geocode-glib - Remove the libsoup 2 build - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 3.13.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - Update to 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 3.12.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 3.12.1 - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction - RHEL-46149 CVE-2024-29509 ghostscript: heap buffer overflow via the PDFPassword parameter - RHEL-46131 CVE-2024-29508 ghostscript: heap pointer leak in pdf_base_font_alloc() - RHEL-46112 CVE-2024-29507 ghostscript: stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters - RHEL-46076 CVE-2024-29506 ghostscript: stack-based buffer overflow in the pdfi_apply_filter() - RHEL-44727 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass) - RHEL-44771 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths - Bump release for June 2024 mass rebuild - RHEL-38835 run the package with correct tests - RHEL-38835 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free bypass via Type 5 shading OOB write and procedure-stream use-after-free - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) - rebuild - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850) - fix giftext memmory access error (RHEL-77803) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Actually apply test patch Related: Resolves: RHEL-58016 - Update mozjs to 115.15.0 Resolves: RHEL-58016 - Replace xvfb dependency Resolves: RHEL-36637 - Bump bundled mozjs version Resolves: RHEL-45601 - Re-enable LTO for all archs Resolves: RHEL-40915 - Bump release for June 2024 mass rebuild - Adjust rpminspect configuration - Bundle mozjs on RHEL - Fix SPDX license information - Add rpminspect configuration - Update to 1.80.2 - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Allow to get startup notify ID without GAppInfo - Backport patch to prevent sending a serial of zero on overflow - Sync the content of main.fmf from rhel9 to rhel10 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Add new systemtap-sdt-dtrace to build deps - Add patch to fix test failure with newer tzdata - metadata preparation for RHIVOS RHELMISC-7537 - Bump release for October 2024 mass rebuild: - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Allow to get startup notify ID without GAppInfo - Backport patch to prevent sending a serial of zero on overflow - Sync the content of main.fmf from rhel9 to rhel10 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Add new systemtap-sdt-dtrace to build deps - Add patch to fix test failure with newer tzdata - metadata preparation for RHIVOS RHELMISC-7537 - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Fix CVE-2026-58013: GIOChannel memcmp buffer over-read - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime byte-swap - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Fix CVE-2026-58013: GIOChannel memcmp buffer over-read - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Allow to get startup notify ID without GAppInfo - Backport patch to prevent sending a serial of zero on overflow - Sync the content of main.fmf from rhel9 to rhel10 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Add new systemtap-sdt-dtrace to build deps - Add patch to fix test failure with newer tzdata - metadata preparation for RHIVOS RHELMISC-7537 - Bump release for October 2024 mass rebuild: - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Allow to get startup notify ID without GAppInfo - Backport patch to prevent sending a serial of zero on overflow - Sync the content of main.fmf from rhel9 to rhel10 - Add patches for CVE-2024-52533 and CVE-2025-4373 - Add new systemtap-sdt-dtrace to build deps - Add patch to fix test failure with newer tzdata - metadata preparation for RHIVOS RHELMISC-7537 - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Fix CVE-2026-58013: GIOChannel memcmp buffer over-read - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Add patch for CVE-2025-13601 and patches for GUnixMount issues - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime byte-swap - Fix CVE-2026-15588: limit D-Bus auth line read length - Fix CVE-2026-58011: range validation in g_date_time_add_full() - Fix CVE-2026-58012: buffer overflow in gregex.c with G_REGEX_RAW - Fix CVE-2026-58010: off-by-one in GVariant tuple offset checking - Fix CVE-2026-58015: validate D-Bus DBUS_COOKIE_SHA1 cookie context - Fix CVE-2026-58014: heap under-read in g_key_file_get_locale_string_list - Fix CVE-2026-58013: GIOChannel memcmp buffer over-read - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation - Fix CVE-2025-14087 and CVE-2025-14512 - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Bump release for October 2024 mass rebuild: - Require libsigc++30 and not 20 - Bump release for June 2024 mass rebuild - gating enabled - Update to 2.78.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.78.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.77.0 - Bump release for October 2024 mass rebuild: - Require libsigc++30 and not 20 - Bump release for June 2024 mass rebuild - gating enabled - Update to 2.78.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.78.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.77.0 - Update to 1.4.328.1 SDK - Update to SDK v1.4.313 - Update to 1.4.304.0 SDK - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - License: AND must be all capital letters - Update license identifiers - Update to 1.3.283.0 SDK - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.4.5 - Bump release for June 2024 mass rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.4.4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 47.1 Resolves: RHEL-62344 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 46.beta - Update to 42.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 42.7 - Update to 42.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 46.3. Resolves: RHEL-89562 - Update to 46.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 46.alpha - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0.2 - Update to 45.0.1 - Update to 45.0 - Resolve RHEL-74223 Fix SPDX license - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Resolve RHELPLAN-170235 Fix OpenScanHub report - Fix typo - Resolve RHELPLAN-170235 Fix OpenScanHub report - Fix deprecated g_spawn_check_exit_status with -Wdeprecated-declarations - Fix uninitialized n_failed with -Wanalyzer-use-of-uninitialized-value - Fix to check return value of g_setenv() with CWE-252 - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - Bump release for June 2024 mass rebuild - License migrated to SPDX format - Sync gnome-qr library patch series with upstream MR - Get qrcodegen tar file from lookaside cache - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - Bump release for June 2024 mass rebuild - License migrated to SPDX format - Sync gnome-qr library patch series with upstream MR - Get qrcodegen tar file from lookaside cache - tests submodule needs explicit Requires - Add gnome-qr library used by passwordless GDM - Update to 44.1 - Drop live user mode patchset - Bump release for October 2024 mass rebuild: - Convert subpackages to SPDX license format - Fix license tag so its validated by license-validate - Add gating.yaml via API - Fix Calculator to be presented - Papers should be in Utilities and not in Graphics and Office - Resolves: RHEL-65839 - Incorporate review feedback - Resolves: RHEL-65839 - Use autosetup - Rename 14.patch to gnome-menus-01.patch - Rearrange after design review - Resolves: RHEL-65839 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: RHEL-103392 (Update to 3.52.8) - Resolves: RHEL-74840 (Update to 3.52.3.1) - Resolves: RHEL-69591 (Update to 3.52.2) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-63179 (Update to 3.52.1) - Resolves: RHEL-60879 (Update to 3.52.0) - Resolves: RHEL-53973 (Update to 3.51.3) - Related: RHEL-45844 (Update to 3.51.0) - Resolves: RHEL-45186 (Fix issues found by Coverity Scan) - Bump release for June 2024 mass rebuild - Disable subman plugin - Consider special modules for smartcard detection - Backport more auto-brightness related fixes - Fix auto-brightness with gnome-shell 49.x - Use gnome-shell interface for brightness control - subman: Delay startup notification by 30 minutes - Add subscription manager plugin - Add g-s-d-server-defaults subpackage for "Server with GUI" overrides - Revert "Add downstream default suspend setting for servers" - Disambiguate mount points with same name on "Low Disk Space" notifications - Bump to 47 - Bump release for October 2024 mass rebuild: - Add gating.yaml - Add gnome-shell-47 - Impelemt CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Bump to 46 - Add gnome-shell-46 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-123944 (Carousel does not respect the "enable-animations" a11y setting) - Resolves: RHEL-84652 (Update to 47.5) - Resolves: RHEL-73685 (Update to 47.4) - Resolves: RHEL-69592 (Update to 47.2) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-62353 (Update to 47.1) - Resolves: RHEL-58962 (Rebase to 47.0) - Resolves: RHEL-52807 (Update to 46.4) - Resolves: RHEL-39680 (Re-enable build of the fedora-langpacks subpackage in RHEL) - Resolves: RHEL-45603 (Update to 46.3) - add Provides: golang(github.com/russross/blackfriday/v2) - Resolves: RHEL-86199 - re-add -devel and compat - Resolves: RHEL-65351 - don't build devel and compat packages - Resolves: RHEL-65307 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - AlmaLinux change: Set arch as x86_64_v2 for config file - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - fix plan definition - fix static analysis findings (RHEL-44568) - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - add signature file - Update to 1.23.2 - add tarball signature verification - updated to 1.22.0 - AlmaLinux change: Set arch as x86_64_v2 for config file - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - fix plan definition - fix static analysis findings (RHEL-44568) - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - add signature file - Update to 1.23.2 - add tarball signature verification - updated to 1.22.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Dropped ocaml in RHEL>9 Resolves: RHEL-16474 - Rebuild for golang 1.22.0 - Added hpnd-uc license - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Use transaction file triggers to configure plugins - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - License converted to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix bytes/bits confusion in AV1 tile data size parsing (CVE-2026-52718) Resolves: RHEL-184391 - Fix for CVE-2026-52719 Resolves: RHEL-184406 - Fix integer overflows in VMnc decoder (CVE-2026-52722) Resolves: RHEL-184425 - Fix for CVE-2026-52720: validate framebuffer update rectangles in VNC source plugin's RFB decoder Resolves: RHEL-184462 - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - fix for CVE-2025-3887 Resolves: RHEL-93045 - Update to 1.24.11 Resolves: RHEL-73674 - Update to 1.24.10 Resolves: RHEL-70406 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550 - Fix bytes/bits confusion in AV1 tile data size parsing (CVE-2026-52718) Resolves: RHEL-184391 - Fix for CVE-2026-52719 Resolves: RHEL-184406 - Fix integer overflows in VMnc decoder (CVE-2026-52722) Resolves: RHEL-184425 - Fix for CVE-2026-52720: validate framebuffer update rectangles in VNC source plugin's RFB decoder Resolves: RHEL-184462 - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - fix for CVE-2025-3887 Resolves: RHEL-93045 - Update to 1.24.11 Resolves: RHEL-73674 - Fix ADPCM decoder input validation (CVE-2026-19387) Resolves: RHEL-235500 - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550 - Fix bytes/bits confusion in AV1 tile data size parsing (CVE-2026-52718) Resolves: RHEL-184391 - Fix for CVE-2026-52719 Resolves: RHEL-184406 - Fix integer overflows in VMnc decoder (CVE-2026-52722) Resolves: RHEL-184425 - Fix for CVE-2026-52720: validate framebuffer update rectangles in VNC source plugin's RFB decoder Resolves: RHEL-184462 - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156114, RHEL-156172 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - fix for CVE-2025-3887 Resolves: RHEL-93045 - Add patches for CVE-2026-2923 and CVE-2026-3082 Resolves: RHEL-156118, RHEL-156189 - Update to 1.26.7 Resolves: RHEL-126057 - Update to 1.26.2 Resolves: DESKTOP-1858 - fix for CVE-2025-3887 Resolves: RHEL-93045 - Update to 1.24.11 Resolves: RHEL-73674 - Update to 1.24.10 Resolves: RHEL-70406 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - 1.24.6 - Rebuild for opencv 4.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add tests/gobject/examples to path argument (#2254318 #2261221) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix ownership of cmake directory - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.1 release - Await more motion events before deactivating menus Resolves: RHEL-47037 - Stop relying on xpms in the testsuite Resolves: RHEL-69453 - Avoid criticals on headless systems Resolves: RHEL-40884 - Hide emoji chooser unless explicitly requested Resolves: RHEL-65214 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Don't require package gtk-immodules-imsettings as it isn't part of RHEL 10 (it's built from GTK 2 SRPM which isn't presented) - Resolves: RHEL-38223 - Update to 3.24.43 - Resolves: RHEL-46990 - Bump release for June 2024 mass rebuild - Update to 3.24.42 - Enable profiler support - Update to 3.24.41 - Update to 3.24.40 - Update to 3.24.39 - Use a gtk3 servers file if it exists - Fix a focus problem in the file chooser - Hide emoji chooser unless explicitly requested - Update to 4.16.7 - Bump release for October 2024 mass rebuild: - Update to GTK 4.16.3 - Fix missing popovers - Update to 4.15.3 - Bump release for June 2024 mass rebuild - Stop using objcopy for resources - vulkan: Add VkMemoryDedicatedAllocateInfo for dmabufs - Use a gtk3 servers file if it exists - Fix a focus problem in the file chooser - Hide emoji chooser unless explicitly requested - Update to 4.16.7 - Bump release for October 2024 mass rebuild: - Update to GTK 4.16.3 - Fix missing popovers - Use a gtk3 servers file if it exists - Fix a focus problem in the file chooser - Hide emoji chooser unless explicitly requested - Update to 4.16.7 - Bump release for October 2024 mass rebuild: - Update to GTK 4.16.3 - Fix missing popovers - Update to 4.15.3 - Bump release for June 2024 mass rebuild - Stop using objcopy for resources - vulkan: Add VkMemoryDedicatedAllocateInfo for dmabufs - Use a gtk3 servers file if it exists - Fix a focus problem in the file chooser - Hide emoji chooser unless explicitly requested - Update to 4.16.7 - Bump release for October 2024 mass rebuild: - Update to GTK 4.16.3 - Fix missing popovers - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 4.13.2 - Update to 4.13.1 - Update to 4.12.0 - Drop COPYING.tools and remove GPL-2.0-or-later from license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 4.11.3 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - gating enabled - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 4.13.2 - Update to 4.13.1 - Update to 4.12.0 - Drop COPYING.tools and remove GPL-2.0-or-later from license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 4.11.3 - Update to 5.14.2 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.10.0 - Update to 5.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 32.1.3 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.3.1 release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add Automatic-Module-Name manifest entry - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upstream update to 1.49.3. - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56804 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Perl 5.40 rebuild - Rebuilt for Python 3.13 - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 4.5.14 - Build with default JDK 17 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52711 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Port to Mockito 5 - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 4.4.16 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update pci and vendor ids Resolves: RHEL-110938 - Update pci, usb and vendor ids Resolves: RHEL-110937 - Update pci, usb and vendor ids Resolves: RHEL-78367 - Update pci, usb and vendor ids Resolves: RHEL-78366 - Update pci and vendor ids Resolves: RHEL-57033 - Update pci, usb and vendor ids Resolves: RHEL-57033 - Update pci, usb and vendor ids Resolves: RHEL-57032 - Update pci, usb and vendor ids Resolves: RHEL-42439 - Update pci, usb and vendor ids Resolves: RHEL-42416 - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Resolves: RHEL-83888 Bump to 1.5.32 - Rebuild to export GSK_RENDERER=cairo in CentOS but not RHEL for Vulkan - Move gnome-calendar & gnome-epub-thumbnailer to Fedora specific in CI - Bump to 1.5.31 - Delete RHEL specific packages - Update installed packages in CI - configure option for Flatpak build - Move xinit post scripts - Require gnome-shell-extension-no-overview in RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Delete tmt installation for RHEL10 CI - Disable ibus-panel rich condition in RHEL - Delete ibus-xx-desktop-testing-mutter.patch - Delete libXtst-devel dependency - Replace gnome-terminal with ptyxis - Install gnome-desktop-testing for RHEL - Delete xorg-x11-server-Xvfb gnome-session-xsession - Delete build packages for gnome-desktop-testing for RHEL - Move evince gnome-logs gvfs-fuse gvfs-gphoto2 gvfs-smb to Fedora specific - Fix CI test case conditions - Add no-overview@fthx until gnome-shell-extension-no-overview is available - Add gnome-headless-session@.service until GDM will provide it - Replace GNOME Xorg with GNOME Wayland in CI - Replace STI with TMT in CI - Update CI for RHEL packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - ima-setup: Use RSAHEADER to tell if a package has been signed - ima-setup: skip installing rpm-plugin-ima if it has been installed (RHEL-99356) - ima-setup: rebuild all initramfs images to include the integrity dracut module (RHEL-92638) - Verify IMA signature to make sure it's correct - ima-setup: run zipl after building initramfs for s390x (RHEL-82392) - Disable compat lib (RHEL-65376) - Update to upstream 1.6 (RHEL-65376) - add some IMA setup tools (RHEL-34778) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - Update to 3.1.10. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for Boost 1.83 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 3.1.9. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - New upstream release 58 (#2260272) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Move INIReader C++ library to inih-cpp subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release 57 (#2221191) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump for rebuild now that gating tests are enabled. - Resolves: RHEL-62928 - Bump release for rebuild. - Resolves: RHEL-62928 - Bump release for rebuild. - Resolves: RHEL-62928 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Minor spec file updates - Verify the License tag carries an SPDX expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - iproute-6.17.0-2.el10 - iproute-6.17.0-1.el10 - iproute-6.14.0-2.el10 - iproute-6.14.0-1.el10 - Add image-mode testing - Add tmt test plan - Fix gating yaml - iproute-6.11.0-1.el10 - Use osci.brew-build.tier0.functional as test_case_name in gating.yaml - Bump release for October 2024 mass rebuild: - Use modules-core for conditional modules-extra dependency - Do not require kernel-modules-extra-matched meta package - Require new kernel-modules-extra-matched meta package - fix kernel-modules-extra dependency for aarch64 64k variant [RHEL-83582] - Bump for sidetag build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add legacy actions for service save support - ipset-services to depend on iptables-nft-services - Require kernel-modules-extra - Bump release to trigger CI - Bump release to trigger CI - Turn absolute ipset-translate symlink into a relative one - Rebase onto 7.22 plus fixes - avoid pulling in kernel package if not needed - spec: Soft-depend on kernel-modules-extra - Use modules-core for conditional modules-extra dependency - Do not require kernel-modules-extra-matched meta package - Require new kernel-modules-extra-matched meta package - fix kernel-modules-extra dependency for aarch64 64k variant [RHEL-83582] - Bump for sidetag build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add legacy actions for service save support - ipset-services to depend on iptables-nft-services - Require kernel-modules-extra - Bump release to trigger CI - Simplify Recommends again, kernel fixed Provides in modules-core packages - avoid pulling in kernel package if not needed - spec: Soft-depend on kernel-modules-extra - Use modules-core for conditional modules-extra dependency - Do not require kernel-modules-extra-matched meta package - Require new kernel-modules-extra-matched meta package - fix kernel-modules-extra dependency for aarch64 64k variant [RHEL-83582] - Bump for sidetag build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add legacy actions for service save support - ipset-services to depend on iptables-nft-services - Require kernel-modules-extra - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version Resolves: rhbz#2241891 - Add irssi perl-ntype patch for perl>=5.38 Resolves rhbz#2232750 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - verify upstream source signature - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change license, reduce dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.1.2 release - Rebuild - Update to upstream version 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add build-dependency on which - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebase to 2.14 Related: RHEL-30626 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release 4.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Update to jdk-21.0.8+9 (GA) - Update release notes to 21.0.8+9 - Switch to GA mode - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. ** - Resolves: RHEL-102295 - Update to jdk-21.0.8+8 (EA) - Update release notes to 21.0.8+8 - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-101803 - Update to jdk-21.0.8+2 (EA) - Update release notes to 21.0.8+2 - Sync the copy of the portable specfile with the latest update - Add timezone data update check to openjdk_news.sh - Add duplicate check to openjdk_news.sh - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh - Related: RHEL-101803 - Resolves: RHEL-103211 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 - Bump libpng version to 1.6.51 following JDK-8372534 - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-142857 - Resolves: RHEL-139565 - Resolves: RHEL-131428 - Resolves: RHEL-131441 - Resolves: RHEL-142861 - Resolves: RHEL-142815 - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Bump rpmrelease for CentOS build - Add scripts to handle tagging of portable-based RPMs - Related: RHEL-118771 - Related: RHEL-119468 - Update to jdk-21.0.9+10 (GA) - Update release notes to 21.0.9+10 - Bump harfbuzz version to 11.2.0 following JDK-8355528 - Add NEWS corrections from Thomas - Use double spacing consistently in notes for this release - Correct 11u release reference to corresponding 21u release as pointed out by Kieran - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2025-10-21 @ 1pm PT. ** - Resolves: RHEL-118771 - Resolves: RHEL-119468 - Use el8 portable packages - Bump release for PQC build - Related: RHEL-235622 - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235622 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188872 - Bump release for PQC build - Related: RHEL-212302 - Related: RHEL-212303 - Related: RHEL-212304 - Related: RHEL-151191 - Related: RHEL-212305 - Related: RHEL-188872 - Related: RHEL-212306 - Related: RHEL-212307 - Related: RHEL-151162 - Update to jdk-21.0.12+8 (GA) - Update release notes to 21.0.12+8 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Update tagging scripts to include signature checks and correctly handle gating - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212302 - Resolves: RHEL-212303 - Resolves: RHEL-212304 - Resolves: RHEL-151191 - Resolves: RHEL-212305 - Resolves: RHEL-188872 - Resolves: RHEL-212306 - Resolves: RHEL-212307 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-151162 - Bump release for PQC build - Related: RHEL-169611 - Update to jdk-21.0.11+10 (GA) - Update release notes to 21.0.11+10 - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169611 - Resolves: RHEL-133215 - Resolves: RHEL-146648 - Resolves: RHEL-148326 - Resolves: RHEL-148828 - Resolves: RHEL-157090 - Resolves: RHEL-161216 - Resolves: RHEL-161332 - Resolves: RHEL-169614 - Bump rpmrelease for CentOS build - Related: RHEL-142857 - Related: RHEL-139565 - Related: RHEL-131428 - Related: RHEL-131441 - Related: RHEL-142861 - Related: RHEL-142815 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Sync the copy of the portable specfile with the latest update - Related: RHEL-133733 - Related: RHEL-133735 - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties - Resolves: RHEL-131897 - Incorporate new FIPS patch for 25u - Drop static libjvm.a following adjusted build target for portable build - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS - Patch the nssadapter build to recognise LDFLAGS - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly - Resolves: RHEL-133733 - Resolves: RHEL-133735 - Resolves: RHEL-133763 - Use el9 portable packages - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Execute create-redhat-properties-files.bash with '-e' to exit on failure - Related: RHEL-142855 - Update to jdk-25.0.2+10 (GA) - Update release notes to 25.0.2+10 - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3 - Bump libpng version to 1.6.51 following JDK-8372534 - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch - Test for java.security's existence in create-redhat-properties-files.bash - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. ** - Resolves: RHEL-139579 - Resolves: RHEL-131430 - Resolves: RHEL-131443 - Resolves: RHEL-142855 - Resolves: RHEL-142799 - Use el9 portable packages - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 - Add CVEs to NEWS file - Update to tarball with final changeset ID - Sync the copy of the portable specfile with the latest update - Related: RHEL-188883 - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-8384902 - Bump HarfBuzz version to 14.2.0 following JDK-8385490 - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 - Bump libpng version to 1.6.58 following JDK-8384495 - Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Drop local copy of JDK-8375294 EOPNOTSUPP patch - Obsolete old RHEL releases (9.7.0-z, 10.1-z) - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269) - Make zone string debug output optional in TestTranslations - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-188883 - Resolves: RHEL-212294 - Resolves: RHEL-212296 - Cleanup tagging and gating scripts to appease shellcheck: - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg. - * scripts/builds/check_signatures.sh: Quote variable usage. - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage. - * scripts/builds/waive_leapp_issue.sh: Likewise. - * scripts/builds/waive_rpminspect.sh: Likewise. - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable. - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage. - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes - Sync the copy of the portable specfile with the latest update - Related: RHEL-155327 - Related: RHEL-155339 - Resolves: RHEL-150977 - Resolves: RHEL-210972 - Resolves: RHEL-210993 - Update to jdk-25.0.3+9 (GA) - Update release notes to 25.0.3+9 - Update FIPS patch to 57722aab802 version synced with 25.0.3+8 - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream - Drop local HarfBuzz patch now JDK-8375057 is included upstream - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 - Bump zlib version to 1.3.2 following JDK-8378631 - Bump tzdata version to 2026a following JDK-8379035 - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4 - Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** - Resolves: RHEL-169620 - Resolves: RHEL-157091 - Resolves: RHEL-161217 - Resolves: RHEL-161333 - Resolves: RHEL-169613 - Add tagging scripts with signature checks and gating handling - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3. - Add gating scripts to simplify obtaining results and waiving issues - Sync the copy of the portable specfile with the latest update - Resolves: RHEL-155327 - Resolves: RHEL-155337 - Resolves: RHEL-155339 - Related: RHEL-155000 - Related: RHEL-146649 - Related: RHEL-148327 - Related: RHEL-148830 - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1 - Resolves: RHEL-150976 - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown - Fix FIPS issue list to represent the new 25u version - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3 - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3 - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3 - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526 - Bump harfbuzz version to 12.3.2 following JDK-8375057 - Bump nssadapter version to bring in shared PKCS11 session fix - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1 - Resolves: RHEL-155000 - Resolves: RHEL-146649 - Resolves: RHEL-148327 - Resolves: RHEL-148830 - Resolves: RHEL-155044 - Bump rpmrelease for CentOS build - Related: RHEL-139579 - Related: RHEL-131430 - Related: RHEL-131443 - Related: RHEL-142855 - Related: RHEL-142799 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52689 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52689 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52689 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52716 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52716 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52716 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Adjust bootstrap build for javapackages-bootstrap update - Resolves: RHEL-52716 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.0.13 - Drop upstreamed duplicated @Deprecated annotations patch - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add bootstrap mode to break a dependency loop - Version 3.0.1 - Convert License tag to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Bootstrap using javapackages-bootstrap - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add bootstrap mode to break a dependency loop - Version 3.0.1 - Convert License tag to SPDX - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52805 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Update to upstream version 3.25.6, resolves rhbz#2192489 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 3.25.2, closes #2115138 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52805 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Update to upstream version 3.25.6, resolves rhbz#2192489 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 3.25.2, closes #2115138 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.0.1 - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.0.4 - Update to upstream version 4.0.3 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.0.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.5.1 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove provision of glassfish artifact - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove unneeded patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.1.1 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt to enable smoke test - Remove unneeded patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.1.1 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt to enable smoke test - Remove unneeded patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.1.1 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt to enable smoke test - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add jaxb-istack-commons-maven-plugin subpackage - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.2.0 - Reorganize subpackages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add jaxb-istack-commons-maven-plugin subpackage - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.2.0 - Reorganize subpackages - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 2.1.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream version 2.1.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.0.4 - Update to upstream version 4.0.3 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.0.2 - Bump release for October 2024 mass rebuild: - add gating configuration - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rebase to 0.20 (rhbz#2238815) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration, spec update - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 4.0.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves rhbz#2092837 jctools-4.0.1 is available - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52690 - Bump release for Aug 2024 java mass rebuild - Fix unexpected permissions of regular files - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52691 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52691 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52691 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52692 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52692 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52693 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52693 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to the upstream v3.6.0 @ 11829386 (RHEL-64946) - Bump release for June 2024 mass rebuild - Update to the upstream v3.5.0 @ 48b2ffc1 (RHEL-30639) - Rebuild the package for RHEL-10 - Update to the upstream v3.5.0 @ b178ef6b (RHEL-30639) - Use proper SPDX license identifiers - Initial import from Fedora 40 - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Fix CVE-2026-39979 out-of-bounds read in jv_parse_sized() - AddressSanitizer: stack-buffer-overflow in jq_fuzz_execute - Fix signed integer overflow in jvp_array_write - performance test support glibc preload test - Bump release for October 2024 mass rebuild: - Update upstream tests to disable fedora repos - Add gating tests configuration - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52694 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Improve fix of problem on upgrade of doc subpackage - Related: RHEL-65629 - Fix problem on upgrade of doc subpackage - Related: RHEL-65629 - Rebase to 0.18 - Resolves: RHEL-65629 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.17 - Fixes: rhbz#2231647 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.17.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Build with default JDK 17 - Unretire with version 1.16.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Replace CC-BY-2.5 annotations with Apache-2.0 ones - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52712 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.13.2 - Change packaging to jar instead of bundle - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52712 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 4.13.2 - Change packaging to jar instead of bundle - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove build-dependency on asciidoc - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 5.10.2 - Update to upstream version 5.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Remove build-dependency on asciidoc - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 5.10.2 - Update to upstream version 5.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.3.2 - Obsolete javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.3.1 - Update to upstream version 1.3.0 - Skip interface keyword as annotation in name matching only - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52695 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52695 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Do not set environmental variables to prevent clashes with compilation time settings - Create /var/lib/kea through systemd-tmpfiles - Fix files owned by usbmon in image mode - Support for sending startup notifications to systemd II - New version 3.0.2 - Fixes CVE-2025-11232 - New version 3.0.1 - Fixes CVE-2025-40779 - Support for sending startup notifications to systemd - New version 3.0.0 - Remove broken keactrl in favor of systemd unit files - kea.spec: General cleanup and removal of lines that have no effect - kea-msg-compiler was moved from kea to kea-devel - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startup without user intervention - kea.conf: Restrict directory permissions - Sync service files with upstream - Fix leases ownership when switching from root to kea user - Update location of fmf plans - New version 3.0.3 - Fixes CVE-2026-3608 - Do not set environmental variables to prevent clashes with compilation time settings - Create /var/lib/kea through systemd-tmpfiles - Fix files owned by usbmon in image mode - Support for sending startup notifications to systemd II - New version 3.0.2 - Fixes CVE-2025-11232 - New version 3.0.1 - Fixes CVE-2025-40779 - Support for sending startup notifications to systemd - New version 3.0.0 - Remove broken keactrl in favor of systemd unit files - kea.spec: General cleanup and removal of lines that have no effect - kea-msg-compiler was moved from kea to kea-devel - New version 2.6.3 - Fix for: CVE-2025-32801, CVE-2025-32802, CVE-2025-32803 - kea.conf: Remove /tmp/ from socket-name for existing configurations - kea.conf: Set pseudo-random password for default config to secure fresh install and allow CA startup without user intervention - kea.conf: Restrict directory permissions - Sync service files with upstream - Fix leases ownership when switching from root to kea user - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - modprobe: don't attempt to remove an already removed module - Resolves: RHEL-113203 - check weak-updates directory exists before using it - Resolves: RHEL-109793 - Enable zstd compression support for initramfs in weak-modules - Resolves: RHEL-74288 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - weak-modules: fix incorrect symvers file extension dispatch - Resolves: RHEL-61133 - Fix issues discovered by static analysis - Resolves: RHEL-44931 - weak-modules: use either zcat or xzcat based on symvers file extension - Resolves: RHEL-39388 - Bump release for June 2024 mass rebuild - Resolves: RHEL-65759 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: JIRA: https://issues.redhat.com/browse/RHEL-35791 - Update to the latest ksc - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Add explicit requires to the devel subpackages - Resolves: RHEL-60890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rename isnan.3 to lapack-isnan.3 to avoid conflict with man-pages package - update to 3.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - apply upstream fix to https://github.com/Reference-LAPACK/lapack/issues/763 - Adapt license tag to SPDX - Remove .orig file Related: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 2023.2 - Update License field to match SPDX formatting - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for June 2024 mass rebuild - SWIG 4.2 and i686 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update address of b.root-servers.net and some others (#2253462) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for June 2024 mass rebuild - SWIG 4.2 and i686 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update address of b.root-servers.net and some others (#2253462) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for June 2024 mass rebuild - SWIG 4.2 and i686 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update address of b.root-servers.net and some others (#2253462) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Fix string2ibpi function (RHEL-90182) - update to 1.1.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 1.0.0 - package shared ledmon library by Tony Asleson - fix incorrect License field syntax - rebuilt for sg3_utils 1.48 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.84.1 - Fix pkgconfig file regression (rhbz#2255937) - Update to 1.84.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.83.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libXdmcp 1.1.4 - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libXfont2 2.0.6 - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191882 Resolves: https://redhat.atlassian.net/browse/RHEL-191930 Resolves: https://redhat.atlassian.net/browse/RHEL-191949 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221949 - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222024 - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191882 Resolves: https://redhat.atlassian.net/browse/RHEL-191930 Resolves: https://redhat.atlassian.net/browse/RHEL-191949 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libXres 1.2.2 - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libXxf86vm 1.1.5-1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99 - Rebase to upstream 2.9 tarball - Update to changing SONAME (libabigail.so.8.0.0) - Simplify %check section to run both test targets in single invocation - Resolves: RHEL-121667 - Rebuild for c10s - Resolves: RHEL-102574 - Update to upstream 2.8 tarball - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch that is applied upstream. - Update to changing SONAME (libabigail.so.7.0.0) - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid depending on it at runtime - Fix CI relevant issues - Use xxhash functions inlined since xxhash is buildroot-only in RHEL 10.1 - Update to upstream 2.7 tarball - Update to changing SONAME (libabigail.so.6.0.0) - Update to upstream 2.6 tarball - Update to changing SONAME (libabigail.so.5.0.0) - Add BuildRequires xxhash-devel - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to upstream 2.5 tarball - Drop patches (as they are now upstream): 0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch - Enable abidb - Add BuildRequires: python3-devel - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM - Backport patches up to 1.6.10 - 1.6.8: bump patches up to 1.6.8 - Update to 1.6.6 with manual patching - Update to libadwaita 1.6.1 - Bump release for October 2024 mass rebuild: - Update to 1.6.0 - Bump to libadwaita-1.6-rc - Update to 1.6~alpha - Bump release for June 2024 mass rebuild - Fix various openscan issues - Backport patches up to 1.6.10 - 1.6.8: bump patches up to 1.6.8 - Update to 1.6.6 with manual patching - Update to libadwaita 1.6.1 - Bump release for October 2024 mass rebuild: - Update to 1.6.0 - Bump to libadwaita-1.6-rc - Update to 1.6~alpha - Bump release for June 2024 mass rebuild - Fix various openscan issues - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebase to the latest upstream releases - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild against rpm-4.19 (https://fedoraproject.org/wiki/Changes/RPM-4.19) - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release (#2215873) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.8.2 (rhbz#2254881) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 7.8.0 (#2182540) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.8.2 (rhbz#2254881) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 7.8.0 (#2182540) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update license expression. - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - New upstream release - Drop patches merged upstream - Add builddep on python3-setuptools for Python 3.12+ - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 1.5.0 - Bump release for June 2024 mass rebuild - Update Rust macro usage - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update overall license - Remove const-cstr dependency (RHBZ#2214208) - Update to 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to kernel rebase 6.17 - Resolves: RHEL-78997 - Update to kernel rebase 6.14 - Resolves: RHEL-78917 - Update to kernel rebase 6.13 - Resolves: RHEL-91129 - Rebuild after kernel rebase to 6.12 - Resolves: RHEL-63890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to released RHEL 10 Beta kernel - Resolves: RHEL-36077 - Rebase to upstream kernel 6.10 - keep FD_CLOEXEC flag when dup()'ing FD - Resolves: RHEL-37631 - Bump release for June 2024 mass rebuild - Rebuild from latest RHEL 10.0 Beta source tree - Resolves: RHEL-30627 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to kernel rebase 6.17 - Resolves: RHEL-78997 - Update to kernel rebase 6.14 - Resolves: RHEL-78917 - Update to kernel rebase 6.13 - Resolves: RHEL-91129 - Rebuild after kernel rebase to 6.12 - Resolves: RHEL-63890 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to released RHEL 10 Beta kernel - Resolves: RHEL-36077 - Rebase to upstream kernel 6.10 - keep FD_CLOEXEC flag when dup()'ing FD - Resolves: RHEL-37631 - Bump release for June 2024 mass rebuild - Rebuild from latest RHEL 10.0 Beta source tree - Resolves: RHEL-30627 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Upgrade to 1.5.6 (#2216132) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version - 2.10 (Vojtech Trefny) - Rename 'master' branch to 'main' (Vojtech Trefny) - remove dependency on python3-six and python2 crumbs (Alexandre Detiste) - ci: Bump actions/checkout from v3 to v4 (Vojtech Trefny) - Squashed 'translation-canary/' changes from 4d4e65b..5bb8125 (Vojtech Trefny) - dist: Fix release number in spec (Vojtech Trefny) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New version - 2.9 (Vojtech Trefny) - build: Exit before AC_OUTPUT on error (Tomas Bzatek) - tests: fix locale tests on musl (triallax) - Update translation files (Weblate) - Translated using Weblate (Korean) (김인수) - ci: Manually prepare spec file for Packit (Vojtech Trefny) - Rebuilt for Python 3.12 - New version - 2.8 (Vojtech Trefny) - ci: Do not use release descriptions for Packit builds (Vojtech Trefny) - Do not hardcode pylint executable name in Makefile (Vojtech Trefny) - Remove unused test dependencies variables from Makefile (Vojtech Trefny) - docs: Remove information about Python 2 support (Vojtech Trefny) - Various docstring fixes (Vojtech Trefny) - Replace C++ style comments with C style (Vojtech Trefny) - Make use of error optional (Vojtech Trefny) - spec: Fix source archive URL (Vojtech Trefny) - ci: Add Packit automation for downstream builds (Vojtech Trefny) - spec: Bump release to 21 for Packit daily builds (Vojtech Trefny) - ci: Use Packit for daily builds in Copr (Vojtech Trefny) - ci: Remove GitHub action for RPM builds (Vojtech Trefny) - ci: Add Packit configuration for RPM builds on pull requests (Vojtech Trefny) - configure.ac: Remove invalid email address for bug reports (Vojtech Trefny) - ci: Update chroots for RPM builds (Vojtech Trefny) - Translated using Weblate (Kazakh) (Baurzhan Muftakhidinov) - Added translation using Weblate (Kazakh) (Baurzhan Muftakhidinov) - misc: Remove "warn: false" from Ansible "command" (Vojtech Trefny) - Translated using Weblate (Georgian) (Temuri Doghonadze) - spec: Change license string to the SPDX format required by Fedora (Vojtech Trefny) - Added translation using Weblate (Georgian) (Temuri Doghonadze) - Update translation files (Weblate) - Translated using Weblate (Korean) (김인수) - ci: Update Fedora versions for RPM build tests (Vojtech Trefny) - ci: Rename csmock.Dockerfile to ci.Dockerfile (Vojtech Trefny) - ci: Update the csmock GitHub actions configuration (Vojtech Trefny) - ci: Run rpmbuild tests in GitHub actions (Vojtech Trefny) - Add a GitHub action for running csmock static analysis (Vojtech Trefny) - README: Remove the Travis CI badge (Vojtech Trefny) - Sync spec with downstream (Vojtech Trefny) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - migrated to SPDX license, originally from Fedora by <msuchy> - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 1.1.7 * Update ignore list for source tarball generation * Added new assert macros to compare 2 double given an epsilon * Added meson build system * Added header with version to TAP13 output * Fixed issues with MSVC * Fixed TAP output for skipped tests * Fixed issue with fail_msg * CMake generated configs for find_package(cmocka) * Documentation improvements - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 1.1.7 * Update ignore list for source tarball generation * Added new assert macros to compare 2 double given an epsilon * Added meson build system * Added header with version to TAP13 output * Fixed issues with MSVC * Fixed TAP output for skipped tests * Fixed issue with fail_msg * CMake generated configs for find_package(cmocka) * Documentation improvements - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update libcomps to 0.1.21 (RHEL-38831) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport upstream patch to fix C compatibility issue - Fix build with libxml2-2.12.0 - Update to 0.1.20 - Fixes of xml parsing - Fix non-optimized builds by removing inline keyword - Use Py_hash_t instead of long - Backport additional patch to fix segfault in fromxml_str - Backport patch to fix segfault in fromxml_str - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove Xvfb dependency - Bump release for June 2024 mass rebuild - Add gtk3-tests sub package - Add CI - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Drop the requirements on dbus-glib as the project was migrated to GDBus - Build require GTK+ 2 conditionally (follow up fix for previous change) - Delete GTK2 sub packages for RHEL - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump version to 0.2.2 - Fix crash when hiding/showing - Bump version to 0.2.1 - Bump version to 0.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update libdex to 0.8.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Avoid asm.S usage on various Linux architectures - Update to libdex 0.6.1 - Add gating.yaml via API - Update to libdex 0.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for sidetag rebuild - Rebase to 0.2.0 Resolves: RHEL-73467 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Initial import (#2170328) - Add x86_64_v2 to arch_map - Add link to AlmaLinux bugtracker - Fix tests on x86_64_v2 - Fix dnf_keyring_add_public_key() to add multiple keys from a single file (RHEL-156063) - Mark all protected packages as user installed for all transactions (RHEL-128445) - Add `filterUnneededExtraUserinstalled` and Python version to the API - Describe all problems even when there are protected removals (RHEL-146507) - Clearer error for protected package broken dependencies - Fix comparison of RPM items in the transaction (RHEL-128443) - Bump version due to failed build - history DB: Add "persistence" column (RHEL-99825) - conf: Add bootc_unsafe_paths (RHEL-99826) - module: Warn if module config file is inaccessible (RHEL-83804) - Support releasever_{major,minor}, shell-style variable substitution (RHEL-74025) - ConfigParser: make splitReleasever public (RHEL-68034) - Add persistence configuration option (RHEL-78034) - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - migrated to SPDX license, originally from Fedora by <msuchy> - Correct License: some files are GPL 2 or GPL 3, but not later - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild for Konflux (Resolves: RHEL-84822) - Test draft builds with composes - Drop unnecessary PVC - Bump release for final January Konflux build - Bump release for Konflux - Bump release for building in Konflux - Bump release for building in Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - make the build deterministic by serial make process - rebuild in Konflux - Update to 1.5.0 - Update to version 1.3.0 Resolves: RHEL-73468 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libei 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Handle OEFFIS_DEVICE_ALL_DEVICES correctly - libei 1.2.0 - Update to 1.5.0 - Update to version 1.3.0 Resolves: RHEL-73468 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libei 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Handle OEFFIS_DEVICE_ALL_DEVICES correctly - libei 1.2.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update License tag for SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - version bump for -source to CRB PRP - Resolves: RHEL-94337 - fixed OSH findings - Resolves: RHEL-44360 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - version bump for -source to CRB PRP - Resolves: RHEL-94337 - fixed OSH findings - Resolves: RHEL-44360 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix integer underflow in MakerNote decoding (CVE-2026-40386) Resolves: RHEL-170240 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix integer underflow in MakerNote decoding (CVE-2026-40386) Resolves: RHEL-170240 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to upstream release 2.3.1 - Resolves: RHEL-90255, RHEL-99199, RHEL-99208 - Update to upstream release 2.1.0 - Resolves: RHEL-73065 - Update to upstream release 1.22.0 - Resolves: RHEL-16844, RHEL-24119, RHEL-25795 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 1.20.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to 1.2304.0 (new release number scheme, now like rsyslog) Resolves: rhbz#2183193 - Address CVE-2020-12762 Resolves: rhbz#2203170 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - use sysuser setting for uuidd - Fix heap buffer overread in setpwnam() [CVE-2025-14104] - libfdisk: fix off-by-one in maximum last sector calculation - mount: improve --all documentation - libblkid: Fix probe_ioctl_tp assigning BLKGETDISKSEQ as physical - libblkid: use snprintf() instead of sprintf() - lscpu: Add NVIDIA Olympus arm64 core - libfdisk: improve collision reporting - libfdisk: (dos) ignore incomplete EBR for non-wholedisk - wall: always use utmp as fallback - lscpu: update table with ARM IDs - coresched: backport new tool to RHEL-10 - agetty: fix stdin conversion to tty name - blkid: allow up to 64k erofs block sizes - more(1): make sure we have data on stderr - dtc-pylibfdt-libfdt.i-Use-SWIG_AppendOutput.patch [RHEL-64318 RHEL-65448] - dtc-Disable-problematic-waring-flags.patch [RHEL-64318 RHEL-65448] - Resolves: RHEL-64318 ([RHEL10][CS10] dtc fails to build with Swig 4.3.0) - Resolves: RHEL-65448 ([RHEL10][CS10][FTBFS] dtc fails to build on CS10 and RHEL10) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix missing dynamic tags for aarch64 python3 pylibfdt - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Bump release for June 2024 mass rebuild - dtc-Properly-harden-built-packages.patch [RHEL-33493] - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Don't install a Python .egg - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - dtc-pylibfdt-libfdt.i-Use-SWIG_AppendOutput.patch [RHEL-64318 RHEL-65448] - dtc-Disable-problematic-waring-flags.patch [RHEL-64318 RHEL-65448] - Resolves: RHEL-64318 ([RHEL10][CS10] dtc fails to build with Swig 4.3.0) - Resolves: RHEL-65448 ([RHEL10][CS10][FTBFS] dtc fails to build on CS10 and RHEL10) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix missing dynamic tags for aarch64 python3 pylibfdt - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Bump release for June 2024 mass rebuild - dtc-Properly-harden-built-packages.patch [RHEL-33493] - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Don't install a Python .egg - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory leak in credman Resolves: RHEL-35253 - Bump release for June 2024 mass rebuild - Rebuilt for libcbor 0.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.14.0 release ( resolves: rhbz#2249531 ) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for libcbor 0.10.2 - Update to 1.13.0 release ( resolves: rhbz#2172297 ) - Perform some deglobing of files per packaging guidelines - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Provide flex-doc via the main flex package - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Analyse flex sources for license information - Migrate License field to SPDX identifiers for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 (#2222083) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libfontenc 1.1.7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libfontenc 1.1.6 - Goodixmoc: Fix use-after-free when receive an incorrect CRC - Fix the goodixmoc crash in exiting callback - Update to upstream version 1.94.9 - Add PID 0x107 and 0x108 for the Synaptics fingerprint sensor - Update to upstream release 1.94.8 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to 1.94.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add MinGW packages. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - new version - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Trigger Vala compilation during build, for GCC 14 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild (exiv2) Resolves: RHEL-52972 - Update to 0.14.3 Resolves: RHEL-46522 - Drop the python3 sub-package Resolves: RHEL-45529 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - fix bluetooth issue with libmtp (RHEL-141270) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - RHEL-46575 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction - RHEL-46149 CVE-2024-29509 ghostscript: heap buffer overflow via the PDFPassword parameter - RHEL-46131 CVE-2024-29508 ghostscript: heap pointer leak in pdf_base_font_alloc() - RHEL-46112 CVE-2024-29507 ghostscript: stack-based buffer overflow via the CIDFSubstPath and CIDFSubstFont parameters - RHEL-46076 CVE-2024-29506 ghostscript: stack-based buffer overflow in the pdfi_apply_filter() - RHEL-44727 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass) - RHEL-44771 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths - Bump release for June 2024 mass rebuild - RHEL-38835 run the package with correct tests - RHEL-38835 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - CVE-2026-103226 ghostscript: ghostscript: stack-based buffer overflow in pdfwrite via crafted font data - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free bypass via Type 5 shading OOB write and procedure-stream use-after-free - RHEL-264925 CVE-2026-39919 ghostscript: Heap buffer overflow in JPEG 2000 JPXDecode output adapter - RHEL-88964 CVE-2025-27832 ghostscript: NPDL device: Compression buffer overflow - RHEL-67044 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space - RHEL-67050 CVE-2024-46952 ghostscript: Buffer Overflow in Ghostscript PDF XRef Stream Handling - RHEL-67050 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding - RHEL-67050 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript - RHEL-67050 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Synchronize to packaging changes in Fedora 40: Resolves: RHEL-66920 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix building against libxml 2.12.0 - Use pkgconfig for BuildRequires - New upstream release 1.14.51 - Resolves: rhbz#2214335 rhbz#2249742 rhbz#2249979 - Add MinGW packages - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Port configure script to C99 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.41.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Enable building for ppc64le - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Update to libguestfs-1.58.1-6 - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun) - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys) - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml - Update common submodule - Apply patches with %autosetup -S git (a patch now adds binary test data) - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - Enable building for ppc64le - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Enable building for ppc64le - Add setfiles optional excludes parameter to libguestfs resolves: RHEL-239808 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Enable building for ppc64le - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Update to libguestfs-1.58.1-6 - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun) - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys) - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml - Update common submodule - Apply patches with %autosetup -S git (a patch now adds binary test data) - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - Enable building for ppc64le - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Enable building for ppc64le - Add setfiles optional excludes parameter to libguestfs resolves: RHEL-239808 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Enable building for ppc64le - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Update to libguestfs-1.58.1-6 - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun) - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys) - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml - Update common submodule - Apply patches with %autosetup -S git (a patch now adds binary test data) - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - Enable building for ppc64le - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Enable building for ppc64le - Add setfiles optional excludes parameter to libguestfs resolves: RHEL-239808 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - RHEL-34651 Update to release 0.4.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - Epoch needs to be added to the devel package requirement - Remove epoch from devel requirements - Add epoch to fix upgrades and update to 4.4.4 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Resolves: RHEL-30234 (Update to 4.4.2 release) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Unretire libgweather package, rename libgweather4 back to libgweather - Epoch needs to be added to the devel package requirement - Remove epoch from devel requirements - Add epoch to fix upgrades and update to 4.4.4 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Resolves: RHEL-30234 (Update to 4.4.2 release) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Unretire libgweather package, rename libgweather4 back to libgweather - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Move away from xvfb-run (done by nielsdg@redhat.com in Fedora) - Bump release for June 2024 mass rebuild - Update to 1.8.3 - Re-enable tests on s390x - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport an upstream patch to fix a write after free issue (rhbz#2253814) - Disable glade catalog in RHEL builds - BR: rsvg-pixbuf-loader for svg support in tests - Do not run modprobe in %post if the system is not running - Resolves: RHEL-78695 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix SPDX license identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-32074 (Update to 3.0.18) - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.0.17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for ICU 73.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-32074 (Update to 3.0.18) - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.0.17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for ICU 73.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-32074 (Update to 3.0.18) - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.0.17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for ICU 73.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libinput 1.30.1 Resolves: RHEL-136390 - libinput 1.28.1 Resolves: RHEL-126613 - Add quirks for four Dell pressure pads (RHEL-106932) - Fix negative value range for the dial to ring-mapping (RHEL-104952) - Support Wacom Intuos Pro 3rd by mapping the dial to a ring (RHEL-104952) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - libinput 1.26.1 - Bump release for June 2024 mass rebuild - libinput 1.26.0 - Mark datadir/libinput as owned by us (#2283754) - CVE-2026-50292: sanitize phys before printing it in libinput-device-group Resolves: RHEL-182371 - libinput 1.30.1 Resolves: RHEL-136390 - libinput 1.28.1 Resolves: RHEL-126613 - Add quirks for four Dell pressure pads (RHEL-106932) - Fix negative value range for the dial to ring-mapping (RHEL-104952) - Support Wacom Intuos Pro 3rd by mapping the dial to a ring (RHEL-104952) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - libinput 1.26.1 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable python support. This package is only in RHEL 10, because tracker-miners requires it and it doesn't need the Python bits. - Resolves: RHEL-52843 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Upgrade to 1.5.6 (#2216134) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Upgrade to 1.5.6 (#2216133) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - New upstream release - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - New upstream release - migrated to SPDX license - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebase jose-14 upstream version to c10s - Enable fmf metadata format for jose - Enable RHEL gating for jose - Update to release v12 - Fix test when using zlib-ng - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to 1.30 Resolves: RHEL-69636 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix build on i686 machines - New upstream release - Fix potential startup race condition (corosync use case) - Fix crypto config check - Minor API cleanup - Test suite fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - Improve TX performance and use less CPU - minor other improvements - Build system update - migrated to SPDX license - Rebase to 1.30 Resolves: RHEL-69636 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Fix build on i686 machines - New upstream release - Fix potential startup race condition (corosync use case) - Fix crypto config check - Minor API cleanup - Test suite fixes - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - Improve TX performance and use less CPU - minor other improvements - Build system update - migrated to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New upstream release (#2265627) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release (#2250046) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release (#2215873) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - New upstream release (#2155172) - Rebase to 1.1.3 Resolves: RHEL-127169 - Bump release for CRB inclusion Resolves: RHEL-96893 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Review fixes - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Allow dropping empty json objects Resolves: RHEL-39979 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Port pcre dependency to pcre2 resolves: rhbz#2128320 - Update License tag for SPDX - Apache 2.0 was missing according to upstream sources - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix configure.ac/configure glitch (#2141801) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Hardlink, rather than symlink, duplicate table files - Fix RHEL build after RPATH removal - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.28.0 - Install internal.h for MuseScore - Drop ancient obsoletes - Build the python package with dist-info - Add tables subpackage for the noarch data - Complete and correct SPDX migration - Remove need for chrpath - Minor spec file cleanups - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 3.25.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Hardlink, rather than symlink, duplicate table files - Fix RHEL build after RPATH removal - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.28.0 - Install internal.h for MuseScore - Drop ancient obsoletes - Build the python package with dist-info - Add tables subpackage for the noarch data - Complete and correct SPDX migration - Remove need for chrpath - Minor spec file cleanups - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 3.25.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Hardlink, rather than symlink, duplicate table files - Fix RHEL build after RPATH removal - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.28.0 - Install internal.h for MuseScore - Drop ancient obsoletes - Build the python package with dist-info - Add tables subpackage for the noarch data - Complete and correct SPDX migration - Remove need for chrpath - Minor spec file cleanups - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 3.25.0 - Align to upstream release 10 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Enable fmf init for luksmeta - Enable RHEL gating for jose - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update libmad to 0.16.4 - Drop Add_unversioned_so.patch, upstream fixed it - mad.pc is back - copy libmad.pc to mad.pc for compatibility - Update to 0.16.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upgrade to 1.9.1 (#2257602) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upgrade to 1.8.0 (#2248696) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 1:1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Update to 1:0.9.77 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1:0.9.76 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 1:1.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license format - Update to 1:0.9.77 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1:0.9.76 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without STI tests - Fix building with glib2-doc 2.80.1 (RHEL-45188) - Bump release for June 2024 mass rebuild - Fix building with glib2-doc 2.79.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuild for rpm-4.18.90 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Disable player match that breaks Bluetooth on Mediatek MT7925 adapters (RHEL-116829) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Disable player match that breaks Bluetooth on Mediatek MT7925 adapters (RHEL-116829) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to libnbd 1.24.1 resolves: RHEL-111243 - Synch spec file with Fedora - Fix unsanitized hostnames in nbd+ssh URIs allow remote execution resolves: RHEL-129296 - Implement Post-Quantum Cryptography (PQC) resolves: RHEL-101267 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - applied patch to fix static analysis errors https://github.com/libnet/libnet/pull/170 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for beta - Bump release to trigger CI - Bump release to trigger CI - conntrack: bsf: Do not return -1 on failure - Bump release to trigger CI - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license to SPDX format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for gating CI - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to version 1.0.2 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - mountd: Minor refactor of get_rootfh() (RHEL-127093) - mountd: Separate lookup of the exported directory and the mount path (RHEL-127093) - support: Add a mini-library to extract and apply RPC credentials (RHEL-127093) - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127093) - Add requires for selinux-policy (RHEL-127093) Resolves: CVE-2025-12801 - nfsiostat: normalize the mountpoints passed in from the command line (RHEL-90562) - Remove /var/lib/nfs/v4recovery (RHEL-137935) - gssd: protect kerberos ticket cache access (RHEL-138461) - nfsrahead: modify get_device_info logic (RHEL-115964) - Fix dependency definition in rpc-statd.service (RHEL-96937) - Updated to nfs-utils-2-8-3 plus additional fixes from 2-8-4-rc1 (RHEL-88768) Resolves: RHEL-71286 Resolves: RHEL-82418 Resolves: RHEL-82557 Resolves: RHEL-85409 Resolves: RHEL-85413 Resolves: RHEL-88768 - fix ownership of /var/lib/nfs/statd/state (RHEL-77913) - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-77912) - version handling fixes for nfsdctl and rpc.nfsd (RHEL-72477) - nfsdcltrack related manpage and configure file cleanup (RHEL-73500) - Updated to the latest release: nfs-utils-2-8-2 (RHEL-67786) Resolves: RHEL-65826 Resolves: RHEL-67041 Resolves: RHEL-67168 Resolves: RHEL-67786 Resolves: RHEL-68575 - src: Do not include userdata content in debug output (Phil Sutter) [RHEL-119650] - Revert "udata: Store u32 udata values in Big Endian" (Phil Sutter) [RHEL-119650] - udata: Store u32 udata values in Big Endian (Phil Sutter) [RHEL-119650] - data_reg: Support concatenated data (Phil Sutter) [RHEL-119650] - data_reg: Respect data byteorder when printing (Phil Sutter) [RHEL-119650] - Introduce nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-119650] - data_reg: Introduce struct nftnl_data_reg::sizes array (Phil Sutter) [RHEL-119650] - data_reg: Introduce struct nftnl_data_reg::byteorder field (Phil Sutter) [RHEL-119650] - expr: Pass byteorder to struct expr_ops::set callback (Phil Sutter) [RHEL-119650] - expr: data_reg: Avoid extra whitespace (Phil Sutter) [RHEL-119650] - set_elem: Review debug output (Phil Sutter) [RHEL-119650] - utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108860] - utils: Add helpers for interface name wildcards (Phil Sutter) [RHEL-108860] - Rebase onto version 1.3.0 (Phil Sutter) [RHEL-121193] - Bump release for a side-tag build (Phil Sutter) [RHEL-125122] - udata: Introduce NFTNL_UDATA_TABLE_NFT{VER,BLD} (Phil Sutter) [RHEL-113823] - trace: add support for TRACE_CT information (Phil Sutter) [RHEL-103864] - set: Fix for array overrun when setting NFTNL_SET_DESC_CONCAT (Phil Sutter) [RHEL-34697] - Rebase onto version 1.2.8 (Phil Sutter) [RHEL-66276] - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release to trigger CI (Phil Sutter) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifier in package - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for gcr soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.10.6 release - Update to 1.10.4 release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use SPDX license identifier in package - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for gcr soname bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.10.6 release - Update to 1.10.4 release - Fix linked list corruption (RHEL-156539) - Fix gating tests for RHEL-127740 - Rebase to version 1.16.1 (RHEL-127740) - Add a fix for a NULL pointer dereference regression - bump version because the side-tag didn't propagate - Update to version 1.15 (RHEL-113070) - Update to version 1.13 (RHEL-90418) - Update to the latest version v1.11.1 (RHEL-68304) - Update to version 1.10 (RHEL-63282) - Fix RHEL-37611 - Bump release - Related: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - update for recent doxygen - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.5.0 - Update to version 1.3.0 Resolves: RHEL-73468 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libei 1.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Handle OEFFIS_DEVICE_ALL_DEVICES correctly - libei 1.2.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove outdated Requires: gtk2 for the pixbuf-loader (RHEL-45169) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove outdated Requires: gtk2 for the pixbuf-loader (RHEL-45169) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove outdated Requires: gtk2 for the pixbuf-loader (RHEL-45169) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - remove gnulib dependency and use bundled one - RHEL-33500 - apply hardening ldflags for localepaper - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 2.1.0 - update to 2.0.10 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix broken gating - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New version 1.10.4 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - New version 1.10.3 - Fix CVE-2026-0799: validate BPF scratch memory register indices in the BPF interpreter to prevent out-of-bounds memory access Resolves: RHEL-256921 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Disable glade catalog in RHEL builds - Fix obsoletes and provides - Initial version - Recreate RHEL 6.12.0-211.16.1 from CentOS Stream 10 and upstream stable backports (1106-1161) - Drop 211.7.x security-ahead patches superseded by the RHEL backports (1100-1104: crypto authencesn/algif, xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace) - Keep the smb cifs.spnego ahead-fix (1105) - RHEL changelog for 211.8.1..211.16.1 follows: - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300} - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333} - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128} - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607} - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284} - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213] - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213] - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213] - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213] - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060} - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213] - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677} - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431} - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213] - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531] - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408} - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354] - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354] - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354] - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724} - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603} - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402} - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401} - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717] - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717] - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717] - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270} - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157855] - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081] - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081] - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285] - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990] - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741} - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205] - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206] - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946] - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971] - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971] - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766} - Recreate RHEL 6.12.0-211.18.1 from CentOS Stream 10 and upstream stable backports (1162-1244) - RHEL changelog for 211.17.1..211.18.1 follows: - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158} - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023} - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020} - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625] - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov) - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303} - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205} - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375} - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617] - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617] - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617] - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617] - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617] - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331] - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331] - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190} - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116} - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110} - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944] - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051} - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027} - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006} - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434] - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434] - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637] - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637] - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685} - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684} - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180] - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786] - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786] - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786] - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455} - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183} - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645} - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392} - Recreate RHEL 6.12.0-211.20.1 from CentOS Stream 10 and upstream stable backports (1245-1287) - smb cifs.spnego now shipped by RHEL too; existing ahead-fix 1105 is identical (RHEL's redundant copy omitted) - RHEL changelog for 211.19.1..211.20.1 follows: - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178932] {CVE-2026-46243} - redhat/configs: automotive: disable CONFIG_IO_URING (Brian Masney) [RHEL-179469] - sched/deadline: Fix dl_server time accounting (Phil Auld) [RHEL-173950] - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171475] {CVE-2026-31613} - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157466] - Bluetooth: hci_sync: Fix UAF in le_read_features_complete (David Marlin) [RHEL-176903] {CVE-2026-43322} - Bluetooth: hci_sync: fix leaks when hci_cmd_sync_queue_once fails (David Marlin) [RHEL-176903] - Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists (David Marlin) [RHEL-176903] - Bluetooth: L2CAP: Add support for setting BT_PHY (David Marlin) [RHEL-176903] - Bluetooth: hci_conn: Fix using conn->le_{tx,rx}_phy as supported PHYs (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add support for LL Extended Feature Set (David Marlin) [RHEL-176903] - Bluetooth: ISO: Add support to bind to trigger PAST (David Marlin) [RHEL-176903] - Bluetooth: HCI: Add initial support for PAST (David Marlin) [RHEL-176903] - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176915] {CVE-2026-43329} - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175824] - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175824] - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175821] - dpll: add pin operational state (Ivan Vecera) [RHEL-175821] - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172827] - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172827] - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172827] - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172827] - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172827] {CVE-2026-31709} - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167277] - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167837] - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167837] - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172930] - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172930] - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (CKI Backport Bot) [RHEL-171302] - nbd: defer config unlock in nbd_genl_connect (CKI Backport Bot) [RHEL-166953] {CVE-2025-68366} - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163345] {CVE-2025-38653} - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163345] {CVE-2025-38653} - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.26.1 from CentOS Stream 10 and upstream stable backports (1352-1373) - Enable watchdog pretimeout panic functionality for x86 via kernel config (RHEL-182299) - RHEL changelog for 211.23.1..211.26.1 follows: - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177380] {CVE-2026-46331} - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180009] {CVE-2026-46173} - crypto: caam - fix overflow on long hmac keys (CKI Backport Bot) [RHEL-179769] {CVE-2026-43330} - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172772] {CVE-2026-43056} - gitlab-ci: use rhel10.2 builder image (Michael Krausch-Hofmann) - redhat/configs: enable watchdog pretimout panic functionality for x86 (David Arcari) [RHEL-182299] - watchdog: wdat_wdt: Fix ACPI table leak in probe function (David Arcari) [RHEL-182299] - mptcp: fix slab-use-after-free in __inet_lookup_established (CKI Backport Bot) [RHEL-171510] {CVE-2026-31669} - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183319] - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-179723] - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183127] - objtool/klp: Fix unexported static call key access for manually built livepatch modules (Joe Lawrence) [RHEL-178495] - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180307] {CVE-2026-43260} - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180126] {CVE-2026-46125} - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180060] {CVE-2026-46152} - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180022] {CVE-2026-46166} - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179358] {CVE-2026-46056} - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-171774] - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175533] {CVE-2026-31474} - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172516] {CVE-2026-31786} - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172862] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172492] {CVE-2026-31787} - rxrpc: Fix RxGK token loading to check bounds (CKI Backport Bot) [RHEL-171419] {CVE-2026-31641} - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Mircea Dragan) [RHEL-166047] - Recreate RHEL 6.12.0-211.22.1 from CentOS Stream 10 and upstream stable backports (1288-1352) - RHEL changelog for 211.21.1..211.22.1 follows: - scripts/sorttable: Fix endianness handling in build-time mcount sort (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Allow matches to functions before function entry (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use normal sort if theres no relocs in the mcount section (Jerome Marchand) [RHEL-180932] - ftrace: Check against is_kernel_text() instead of kaslr_offset() (Jerome Marchand) [RHEL-180932] - ftrace: Test mcount_loc addr before calling ftrace_call_addr() (Jerome Marchand) [RHEL-180932] - ftrace: Do not over-allocate ftrace memory (Jerome Marchand) [RHEL-180932] - ftrace: Have ftrace pages output reflect freed pages (Jerome Marchand) [RHEL-180932] - ftrace: Update the mcount_loc check of skipped entries (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Zero out weak functions in mcount_loc table (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Always use an array for the mcount_loc sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have mcount rela sort use direct values (Jerome Marchand) [RHEL-180932] - arm64: scripts/sorttable: Implement sorting mcount_loc at boot for arm64 (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use a structure of function pointers for elf helpers (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Get start/stop_mcount_loc from ELF file directly (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Move code from sorttable.h into sorttable.c (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Use uint64_t for mcount sorting (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Sym (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Shdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Add helper functions for Elf_Ehdr (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Sym MACRO over to a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Replace Elf_Shdr Macro with a union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Convert Elf_Ehdr to union (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Make compare_extable() into two functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Have the ORC code use the _r() functions to read (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unneeded Elf_Rel (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused write functions (Jerome Marchand) [RHEL-180932] - scripts/sorttable: Remove unused macro defines (Jerome Marchand) [RHEL-180932] - scripts/sorttable: fix orc_sort_cmp() to maintain symmetry and transitivity (Jerome Marchand) [RHEL-180932] - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the debug and console output in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: add/tweak function header comment blocks in lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: fold lsm_init_ordered() into security_init() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup initialize_lsm() and rename to lsm_init_single() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: cleanup the LSM blob size code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework ordered_lsm_parse() to lsm_order_parse() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename/rework append_ordered_lsm() into lsm_order_append() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename exists_ordered_lsm() to lsm_order_exists() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework the LSM enable/disable setter/getter functions (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: get rid of the lsm_names list and do some cleanup (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rework lsm_active_cnt and lsm_idlist[] (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename the lsm order variables for consistency (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: replace the name field with a pointer to the lsm_id struct (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: rename ordered_lsm_init() to lsm_init_ordered() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate lsm_early_cred() and lsm_early_task() into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: integrate report_lsm_order() code into caller (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: introduce looping macros for the initialization code (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: consolidate lsm_allowed() and prepare_lsm() into lsm_prepare() (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the init code out into lsm_init.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - lsm: split the notifier code out into lsm_notifier.c (Ondrej Mosnacek) [RHEL-179437] {CVE-2026-46054} - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179437] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178413] {CVE-2026-43501} - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172651] {CVE-2026-43037} - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172973] {CVE-2026-31581} - erofs: add GFP_NOIO in the bio completion if needed (CKI Backport Bot) [RHEL-171686] {CVE-2026-31467} - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170764] {CVE-2026-31532} - nouveau/gsp: drop WARN_ON in ACPI probes (Gary Guo) [RHEL-167788] - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176473] - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176473] - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177518] - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Mircea Dragan) [RHEL-166855] - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168073] {CVE-2026-31419} - Recreate RHEL 6.12.0-211.28.1 from CentOS Stream 10 and upstream stable backports (1375-1383) - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1374) - RHEL changelog for 211.27.1..211.28.1 follows: - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-185117] - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174242] {CVE-2026-43198} - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179755] {CVE-2026-43414} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180155] {CVE-2026-46117} - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179665] {CVE-2026-45898} - rxrpc: fix RESPONSE authenticator parser OOB read (CKI Backport Bot) [RHEL-171456] {CVE-2026-31636} - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI Backport Bot) [RHEL-180106] {CVE-2026-46135} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180090] {CVE-2026-46145} - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172675] {CVE-2026-43038} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.30.1 from CentOS Stream 10 and upstream stable backports (1399-1414) - RHEL 6.12.0-211.30.1 now also carries the vgic-its (CVE-2026-46316) and ipv4/ipv6 fraggap fixes AlmaLinux shipped ahead; the AlmaLinux patches (1374, 1384-1385) are retained and RHEL's duplicate copies omitted - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) - RHEL changelog for 211.30.1 follows: - ipv6: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - ipv4: account for fraggap on the paged allocation path (Sabrina Dubroca) [RHEL-191349] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189491] {CVE-2026-43112} - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183592] {CVE-2025-10263} - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182537] - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182537] - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182537] - ASoC: SDCA: fix NULL pointer dereference in sdca_dev_unregister_functions (CKI Backport Bot) [RHEL-185110] - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183965] {CVE-2026-46316} - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181936] {CVE-2026-46244} - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179912] {CVE-2026-46209} - rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - rxrpc: Fix potential UAF after skb_unshare() failure (CKI Backport Bot) [RHEL-179566] {CVE-2026-45998} - Recreate RHEL 6.12.0-211.29.1 from CentOS Stream 10 and upstream stable backports (1386-1398) - Retain AlmaLinux ahead-of-RHEL fixes: CVE-2026-46316 (1374), ipv4/ipv6 fraggap (1384-1385) - RHEL changelog for 211.29.1 follows: - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-180001] {CVE-2026-46176} - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182759] {CVE-2026-31739} - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182759] - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182759] - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182759] - crypto: tegra - remove unneeded crypto_engine_stop() call (Vladislav Dronov) [RHEL-182759] - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181887] - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179965] {CVE-2026-46189} - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179317] {CVE-2026-46090} - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173937] {CVE-2026-43279} - Recreate RHEL 6.12.0-211.31.1 from CentOS Stream 10 and upstream stable backports (1421-1444) - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417) is superseded by RHEL's eventpoll series carrying the same fix and is dropped - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - RHEL changelog for 211.31.1 follows: - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) - RHEL changelog for 211.34.1 follows: - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 (1445, 1446) are superseded by RHEL's copies and dropped - RHEL changelog for 211.33.1 follows: - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are superseded by RHEL's copies and dropped - RHEL changelog for 211.32.1 follows: - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180776] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180776] - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180776] - eventpoll: Fix semi-unbounded recursion (Ian Kent) [RHEL-180776] {CVE-2025-38614} - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180776] - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180776] - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180776] - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180776] {CVE-2026-46242} - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180776] - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180776] - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180776] - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173832] {CVE-2026-43074} - epoll: annotate racy check (Ian Kent) [RHEL-180776] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180048] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180048] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182770] - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181902] {CVE-2026-46259} - net/ipv6: ioam6: prevent schema length wraparound in trace fill (Antoine Tenart) [RHEL-174786] {CVE-2026-43341} - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180277] {CVE-2026-43276} - net: page_pool: avoid false positive warning if NAPI was never added (Ivan Vecera) [RHEL-162140] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192407] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186698] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183007] {CVE-2025-71066} - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179854] {CVE-2026-46227} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - drm/xe/dma-buf: fix UAF with retry loop (Karol Herbst) [RHEL-192232] {CVE-2026-52950} - drm/xe/dma-buf: handle empty bo and UAF races (Karol Herbst) [RHEL-192232] - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Karol Herbst) [RHEL-192232] - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Karol Herbst) [RHEL-192232] - nfsd: cancel async COPY operations when admin revokes filesystem state (Olga Kornievskaia) [RHEL-173103] - nfsd: use correct loop termination in nfsd4_revoke_states() (Olga Kornievskaia) [RHEL-173103] - nfsd: check that server is running in unlock_filesystem (Olga Kornievskaia) [RHEL-173103] - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179887] - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179887] - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179887] - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179887] {CVE-2026-46215} - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179887] - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180697] {CVE-2026-31530} - flex_proportions: make fprop_new_period() hardirq safe (CKI Backport Bot) [RHEL-189658] {CVE-2026-23168} - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188331] {CVE-2026-53071} - redhat/configs: disable CONFIG_PT_RECLAIM (Luiz Capitulino) [RHEL-186311] - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183975] - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-191324 RHEL-192200] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-191324] - ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-191324] - ice: use bitmap_weighted_xor() in ice_find_free_recp_res_idx() (Jakub Ramaseuski) [RHEL-191324] - ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-191324] - ice: fix PTP timestamping broken by SyncE code on E825C (Jakub Ramaseuski) [RHEL-191324] - ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-43346} - ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-191324] - ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-191324] - drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-191324] - ice: fix rxq info registering in mbuf packets (Jakub Ramaseuski) [RHEL-191324] - ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-191324] - ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-191324] - ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-191324] - ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-191324] - ice: fix missing TX timestamps interrupts on E825 devices (Jakub Ramaseuski) [RHEL-191324] - ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-191324] - ice: reshuffle and group Rx and Tx queue fields by cachelines (Jakub Ramaseuski) [RHEL-191324] - ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-191324] - ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-191324] - ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-191324] - ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-191324] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-191324] - ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-191324] - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (Jakub Ramaseuski) [RHEL-191324] {CVE-2026-23166} - bitmap: introduce bitmap_weighted_xor() (Jakub Ramaseuski) [RHEL-191324] - bitmap: add test_zero_nbits() (Jakub Ramaseuski) [RHEL-191324] - bitmap: exclude nbits == 0 cases from bitmap test (Jakub Ramaseuski) [RHEL-191324] - bitmap: test bitmap_weight() for more (Jakub Ramaseuski) [RHEL-191324] - bitmap: add bitmap_weight_from() (Jakub Ramaseuski) [RHEL-191324] - bitmap: align test_bitmap output (Jakub Ramaseuski) [RHEL-191324] - bitmap: switch test to scnprintf("%*pbl") (Jakub Ramaseuski) [RHEL-191324] - bitmap: Add test for out-of-boundary modifications for scatter & gather (Jakub Ramaseuski) [RHEL-191324] - cpumask: Introduce cpumask_weighted_or() (Jakub Ramaseuski) [RHEL-191324] - bitmap: Align documentation between bitmap_gather() and bitmap_scatter() (Jakub Ramaseuski) [RHEL-191324] - bitmap: remove _check_eq_u32_array (Jakub Ramaseuski) [RHEL-191324] - include: update references to include/asm-<arch> (Jakub Ramaseuski) [RHEL-191324] - KEYS: trusted: Fix a memory leak in tpm2_load_cmd (CKI Backport Bot) [RHEL-189604] {CVE-2025-71147} - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (CKI Backport Bot) [RHEL-189576] {CVE-2025-71113} - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188644] {CVE-2026-52976} - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180167] {CVE-2026-46116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (CKI Backport Bot) [RHEL-212681] - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180076] {CVE-2026-46150} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193518] {CVE-2026-52973} - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179299] {CVE-2026-46099} - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189651] {CVE-2026-23110} - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188547] {CVE-2026-53059} - rtnetlink: add missing netlink_ns_capable() check for peer netns (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Try the outer netns attribute in rtnl_get_peer_net(). (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: fix double call of rtnl_link_get_net_ifla() (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - veth: Set VETH_INFO_PEER to veth_link_ops.peer_type. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - rtnetlink: Add peer_type in struct rtnl_link_ops. (Guillaume Nault) [RHEL-172537] {CVE-2026-31692} - fs/notify: call exportfs_encode_fid with s_umount (Jay Shin) [RHEL-169188] {CVE-2025-40237} - fs: relax assertions on failure to encode file handles (Jay Shin) [RHEL-169188] - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177856] {CVE-2026-46323} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - KVM: x86: check for invalid/obsolete root after making MMU pages available {CVE-2026-64561} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192215] {CVE-2026-53006} - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192181] {CVE-2026-52993} - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190344] {CVE-2026-53281} - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190344] - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179338] {CVE-2026-46086} - rxrpc: rxrpc_verify_data ensure rx_dec_buffer alloc (Marc Dionne) [RHEL-178254] - rxrpc: Fix the ACK parser to extract the SACK table for parsing (Marc Dionne) [RHEL-178254] - rxrpc: Fix RESPONSE packet verification to extract skb to a linear buffer (Marc Dionne) [RHEL-178254] - rxrpc: Fix DATA decrypt vs splice() by copying data to buffer in recvmsg (Marc Dionne) [RHEL-178254] - crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks (Marc Dionne) [RHEL-178254] - rxrpc: fix oversized RESPONSE authenticator length check (Marc Dionne) [RHEL-178254] {CVE-2026-31635} - rxrpc: Fix integer overflow in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31633} - rxrpc: Fix leak of rxgk context in rxgk_verify_response() (Marc Dionne) [RHEL-178254] {CVE-2026-31632} - rxrpc: Fix buffer overread in rxgk_do_verify_authenticator() (Marc Dionne) [RHEL-178254] {CVE-2026-31631} - rxgk: Fix potential integer overflow in length check (Marc Dionne) [RHEL-178254] - rxrpc: Fix rxkad crypto unalignment handling (Marc Dionne) [RHEL-178254] - rxrpc: Fix memory leaks in rxkad_verify_response() (Marc Dionne) [RHEL-178254] - rxrpc: Fix missing error checks for rxkad encryption/decryption failure (Marc Dionne) [RHEL-178254] - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Marc Dionne) [RHEL-178254] {CVE-2026-43500} - rxrpc: Fix conn-level packet handling to unshare RESPONSE packets (Marc Dionne) [RHEL-178254] - rxrpc: only handle RESPONSE during service challenge (Marc Dionne) [RHEL-178254] {CVE-2026-31676} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-214082] {CVE-2026-64530} - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Rafael Aquini) [RHEL-189554] {CVE-2025-68211} - isofs: validate Rock Ridge CE continuation extent against volume size (CKI Backport Bot) [RHEL-187415] {CVE-2026-46303} - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212063] - ASoC: Intel: sof_sdw: append dai type to dai link name unconditionally (CKI Backport Bot) [RHEL-185669] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - redhat/kernel.spec: make module and modules-core provides use variant (Jan Stancek) [RHEL-213965] - dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-211011] - dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-211011] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-211011] - dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-211011] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-211011] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-211011] - dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-211011] - dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-211011] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-211011] - dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-211011] - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-211011] - drm/i915/psr: Use DC_OFF wake reference to block DC6 on vblank enable (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Block DC states on vblank enable when Panel Replay supported (Anusha Srivatsa) [RHEL-172832] - drm/i915/psr: Don't enable Panel Replay on sink if globally disabled (Anusha Srivatsa) [RHEL-172832] - drm/i915/alpm: ALPM disable fixes (Anusha Srivatsa) [RHEL-172832] - procfs: fix possible double mmput() in do_procmap_query() (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - procfs: avoid fetching build ID while holding VMA lock (Rafael Aquini) [RHEL-189665] {CVE-2026-23199} - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189563] {CVE-2025-68214} - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184266] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134] - ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134] - ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-193134] - ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-193134] - ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-193134] - ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-193134] - ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-193134] - ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-193134] - ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-193134] - ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-193134] - ice: add dpll peer notification for paired SMA and U.FL pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing dpll notifications for SW pins (Jakub Ramaseuski) [RHEL-193134] - ice: fix SMA and U.FL pin state changes affecting paired pin (Jakub Ramaseuski) [RHEL-193134] - ice: fix missing SMA pin initialization in DPLL subsystem (Jakub Ramaseuski) [RHEL-193134] - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (Jakub Ramaseuski) [RHEL-193134] - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-193134] - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Jakub Ramaseuski) [RHEL-193134] - ice: fix ready bitmap check for non-E822 devices (Jakub Ramaseuski) [RHEL-193134] - ice: perform PHY soft reset for E825C ports at initialization (Jakub Ramaseuski) [RHEL-193134] - ice: fix timestamp interrupt configuration for E825C (Jakub Ramaseuski) [RHEL-193134] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-193134] - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-193134] - ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-193134] - ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-193134] - ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-193134] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-193134] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186345] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186345] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186345] - ipv6: ioam: fix heap buffer overflow in __ioam6_fill_trace_data() (CKI Backport Bot) [RHEL-174197] {CVE-2026-43186} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368} - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503] - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505] - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531} - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977} - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554} - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555} - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415} - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035] - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488} - shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072} - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923} - fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (Maurizio Lombardi) [RHEL-213198] {CVE-2026-63887} - perf/aux: Fix page UAF in map_range() (CKI Backport Bot) [RHEL-218475] {CVE-2026-64300} - net/sched: act_api: use RCU with deferred freeing for action lifecycle (CKI Backport Bot) [RHEL-218188] {CVE-2026-53264} - KVM: SVM: make svm_flush_tlb_gva do a full asid flush if NPT enabled (Paolo Bonzini) [RHEL-214436] - KVM: x86: hyper-v: Validate all GVAs during PV TLB flush (Paolo Bonzini) [RHEL-214436] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213472] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213472] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213472] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213472] - accel/ivpu: Fix signed integer truncation in IPC receive (CKI Backport Bot) [RHEL-190054] {CVE-2026-53202} - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-185311] - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-185311] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-185311] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-185311] - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-185311] - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-185311] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-185311] - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-185311] - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-185311] - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-185311] - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-185311] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-185311] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-185311] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-185311] - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-185311] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-185311] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: fix netdev hook allocation memleak with dormant tables (Florian Westphal) [RHEL-185311] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-185311] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-185311] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-185311] - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-185311] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-185311] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-185311] - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: add hook transactions for device deletions (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase (Florian Westphal) [RHEL-185311] - rculist: add list_splice_rcu() for private lists (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-185311] {CVE-2026-46324} - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-185311] - netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-185311] - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-185311] {CVE-2026-45841} - nfnetlink_osf: validate individual option lengths in fingerprints (Florian Westphal) [RHEL-185311] {CVE-2026-23397} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-185311] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-185311] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-185311] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-185311] {CVE-2026-43085} - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-185311] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-185311] {CVE-2026-31424} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-185311] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-185311] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-185311] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-185311] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-185311] {CVE-2026-31416} - netfilter: ctnetlink: use netlink policy range checks (Florian Westphal) [RHEL-185311] {CVE-2026-31495} - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-185311] {CVE-2026-31674} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-185311] - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-185311] - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD (Florian Westphal) [RHEL-185311] {CVE-2026-31428} - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry (Florian Westphal) [RHEL-185311] {CVE-2026-43114} - nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-185311] {CVE-2026-23399} - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case (Florian Westphal) [RHEL-185311] {CVE-2026-23456} - netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() (Florian Westphal) [RHEL-185311] {CVE-2026-23457} - netfilter: conntrack: add missing netlink policy validations (Florian Westphal) [RHEL-185311] {CVE-2026-31407} - netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() (Florian Westphal) [RHEL-185311] {CVE-2026-23458} - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path (Florian Westphal) [RHEL-185311] {CVE-2026-43451} - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() (Florian Westphal) [RHEL-185311] {CVE-2026-43453} - netfilter: nf_tables: unconditionally bump set->nelems before insertion (Florian Westphal) [RHEL-185311] {CVE-2026-23272} - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (Florian Westphal) [RHEL-185311] {CVE-2026-43233} - netfilter: nft_set_hash: fix get operation on big endian (Florian Westphal) [RHEL-185311] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-185311] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-185311] {CVE-2026-23351} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - af_unix: set gc_in_progress to true in unix_gc() {CVE-2026-53361} - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (Maurizio Lombardi) [RHEL-213217] {CVE-2026-63888} - drm/i915: Fix potential UAF in TTM object purge (CKI Backport Bot) [RHEL-222740] {CVE-2026-63884} - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CKI Backport Bot) [RHEL-222567] {CVE-2026-64219} - drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CKI Backport Bot) [RHEL-222667] {CVE-2026-53329} - drm/amdgpu: fix amdgpu_hmm_range_get_pages (Mika Penttilä) [RHEL-222625] {CVE-2026-63879} - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CKI Backport Bot) [RHEL-221336] {CVE-2026-43206} - drm/i915/gem: Fix phys BO pread/pwrite with offset (CKI Backport Bot) [RHEL-222753] {CVE-2026-53356} - drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CKI Backport Bot) [RHEL-222721] {CVE-2026-45878} - drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CKI Backport Bot) [RHEL-222701] {CVE-2026-53143} - drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CKI Backport Bot) [RHEL-222685] {CVE-2026-53136} - drm/amdgpu: zero-initialize GART table on allocation (CKI Backport Bot) [RHEL-222646] {CVE-2026-53374} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v7 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CKI Backport Bot) [RHEL-221380] {CVE-2026-43237} - sched/psi: Create the psimon kthread outside of cgroup_mutex (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - sched/psi: fix race between file release and pressure write (CKI Backport Bot) [RHEL-232560] {CVE-2026-52991} - scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231667] {CVE-2026-63886} - memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228531] {CVE-2026-63952} - mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228531] - vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224545] - xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN (Lukas Herbolt) [RHEL-223954] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - udf: fix partition descriptor append bookkeeping (CKI Backport Bot) [RHEL-179570] {CVE-2026-45991} - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-235459] - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-235459] - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-235459] - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-235459] - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-235459] - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-235459] - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-235459] - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-235459] - crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226717] {CVE-2026-43493} - smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-235812] - smb/client: handle overlapping allocated ranges in fallocate (CKI Backport Bot) [RHEL-236210] {CVE-2026-68388} - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227850] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227850] {CVE-2026-64370} - exit: kill the pointless __exit_signal()->clear_tsk_thread_flag(TIF_SIGPENDING) (Waiman Long) [RHEL-227850] - exit: change the release_task() paths to call flush_sigqueue() lockless (Waiman Long) [RHEL-227850] - smb: client: fix double-free in SMB2_open() replay (CKI Backport Bot) [RHEL-234551] {CVE-2026-64382} - smb: client: mask server-provided mode to 07777 in modefromsid (CKI Backport Bot) [RHEL-234530] {CVE-2026-64379} - smb: client: fix query_info() replay double-free (CKI Backport Bot) [RHEL-234129] {CVE-2026-64386} - smb/client: fix out-of-bounds read in symlink_data() (CKI Backport Bot) [RHEL-229066] {CVE-2026-46185} - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213153] {CVE-2026-64017} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - net: ipv6: clear suppressed fib6 rule result (Jamie Bainbridge) [RHEL-246368] {CVE-2026-74581} - iomap: fix out-of-bounds bitmap_set() with zero-length range (CKI Backport Bot) [RHEL-240183] {CVE-2026-68145} - exfat: fix potential use-after-free in exfat_find_dir_entry() (CKI Backport Bot) [RHEL-231559] {CVE-2026-63808} - KEYS: fix overflow in keyctl_pkey_params_get_2() (CKI Backport Bot) [RHEL-229621] {CVE-2026-63824} - Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error (CKI Backport Bot) [RHEL-223128] {CVE-2026-53073} - smb: client: fix query directory replay double-free (CKI Backport Bot) [RHEL-219150] {CVE-2026-64387} - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - nvmet-auth: reject short AUTH_RECEIVE buffers (CKI Backport Bot) [RHEL-244915] {CVE-2026-72130} - locking/rt: Fix the incorrect RCU protection in rt_spin_unlock() (CKI Backport Bot) [RHEL-242861] {CVE-2026-72069} - s390: Revert support for DCACHE_WORD_ACCESS (John J Coleman) [RHEL-188180] - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC (CKI Backport Bot) [RHEL-234051] {CVE-2026-64298} - nfsd: release layout stid on setlease failure (Scott Mayhew) [RHEL-227794] {CVE-2026-53399} - NFSv4/flexfiles: reject zero filehandle version count (CKI Backport Bot) [RHEL-229415] {CVE-2026-53392} - NFSv4/pNFS: reject zero-length r_addr in nfs4_decode_mp_ds_addr (CKI Backport Bot) [RHEL-228036] {CVE-2026-53391} - NFSD: fix nfs4_file access extra count in nfsd4_add_rdaccess_to_wrdeleg (CKI Backport Bot) [RHEL-227946] {CVE-2026-53026} - pNFS: Fix use-after-free in pnfs_update_layout() (CKI Backport Bot) [RHEL-226322] {CVE-2026-63800} - nfsd: fix posix_acl leak on SETACL decode failure (CKI Backport Bot) [RHEL-225522] {CVE-2026-53397} - mm/khugepaged: write all dirty file folios when collapsing (Rafael Aquini) [RHEL-236329] {CVE-2026-68086} - userfaultfd: prevent registration of special VMAs (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - userfaultfd: correctly prevent registering VM_DROPPABLE regions (Rafael Aquini) [RHEL-237862] {CVE-2026-68166} - crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() (Vladislav Dronov) [RHEL-234477] {CVE-2026-64438} - mm: shrinker: fix NULL pointer dereference in debugfs (Rafael Aquini) [RHEL-230833] {CVE-2026-64417} - mm: shrinker: fix shrinker_info teardown race with expansion (Rafael Aquini) [RHEL-230833] {CVE-2026-64418} - x86/bugs: Make Safe-RET robust against interrupt injection (Waiman Long) [RHEL-230475] {CVE-2026-68480} - crypto: qat - validate RSA CRT component lengths (CKI Backport Bot) [RHEL-234546] {CVE-2026-64304} - Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231446] {CVE-2026-64277} - mm/huge_memory: update file PMD counter before folio_put() (CKI Backport Bot) [RHEL-231228] {CVE-2026-53189} - Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230263] {CVE-2026-64276} - ALSA: virtio: Validate control metadata from the device (CKI Backport Bot) [RHEL-230142] {CVE-2026-64490} - net: mana: validate rx_req_idx to prevent out-of-bounds array access (CKI Backport Bot) [RHEL-229231] {CVE-2026-64018} - smb: client: protect tc_count increment in smb2_find_smb_sess_tcon_unlocked() (CKI Backport Bot) [RHEL-228550] {CVE-2026-64136} - bonding: alb: fix UAF in rlb_arp_recv during bond up/down (CKI Backport Bot) [RHEL-225292] {CVE-2026-45970} - netfilter: ipset: fix race between dump and ip_set_list resize (CKI Backport Bot) [RHEL-227657] {CVE-2026-64189} - iommu/amd: Fix clone_alias() to use the original device's devid (CKI Backport Bot) [RHEL-227452] {CVE-2026-53053} - smb: client: fix change notify replay double-free (CKI Backport Bot) [RHEL-226988] {CVE-2026-64384} - mm/list_lru: drain before clearing xarray entry on reparent (Rafael Aquini) [RHEL-227399] {CVE-2026-53153} - s390/pfault: Fix virtual vs physical address confusion (Ramesh Chhetri) [RHEL-222507] - crypto: qat - cancel work on re-enable SR-IOV timeout (CKI Backport Bot) [RHEL-218627] - nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page (CKI Backport Bot) [RHEL-219623] {CVE-2026-64320} - sctp: hold socket lock when dumping endpoints in sctp_diag (CKI Backport Bot) [RHEL-212393] - seccomp: passthrough uretprobe systemcall without filtering (Ricardo Robaina) [RHEL-210908] {CVE-2025-21834} - qede: fix off-by-one in BD ring consumption on build_skb failure (CKI Backport Bot) [RHEL-193043] - zram: fix use-after-free in zram_bvec_write_partial() (CKI Backport Bot) [RHEL-191442] {CVE-2026-53185} - USB: serial: io_ti: fix heap overflow in build_i2c_fw_hdr() (Desnes Nunes) [RHEL-191042] {CVE-2026-53195} - USB: serial: io_ti: fix heap overflow in get_manuf_info() (Desnes Nunes) [RHEL-191042] {CVE-2026-53196} - ip6_tunnel: use skb_vlan_inet_prepare() in __ip6_tnl_rcv() (CKI Backport Bot) [RHEL-189631] {CVE-2026-23003} - ip6_gre: Use cached t->net in ip6erspan_changelink(). (CKI Backport Bot) [RHEL-180136] {CVE-2026-46120} - netfilter: nf_tables: Fix for duplicate device in netdev hooks (CKI Backport Bot) [RHEL-179761] {CVE-2026-43454} - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179744] {CVE-2026-43450} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - fuse: fix race between interrupt and resend (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req (Miklos Szeredi) [RHEL-218495] {CVE-2026-64265} - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248457] {CVE-2026-64563} - udp: Fix wildcard bind conflict check when using hash2 (Felix Maurer) [RHEL-218016] {CVE-2026-31503} - tcp: optimize inet_use_bhash2_on_bind() (Felix Maurer) [RHEL-218016] - tcp: call sk_data_ready() after listener migration (Felix Maurer) [RHEL-232246] {CVE-2026-46015} - flow_dissector: do not dissect PPPoE PFC frames (Felix Maurer) [RHEL-232629] {CVE-2026-46306} - inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (Felix Maurer) [RHEL-226125] {CVE-2026-46266} - ipv6: anycast: insert aca into global hash under idev->lock (Felix Maurer) [RHEL-230763] {CVE-2026-53259} - ipv6: mcast: Fix use-after-free when processing MLD queries (Felix Maurer) [RHEL-226073] {CVE-2026-53275} - ipv6: prevent possible UaF in addrconf_permanent_addr() (Felix Maurer) [RHEL-225606] {CVE-2026-43339} - net: guard timestamp cmsgs to real error queue skbs (Felix Maurer) [RHEL-225864] {CVE-2026-53223} - net: add pskb_may_pull() to skb_gro_receive_list() (Felix Maurer) [RHEL-229309] {CVE-2026-53235} - can: bcm: extend bcm_tx_lock usage for data and timer updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking when updating filter and timer values (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: fix locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - can: bcm: add locking for bcm_op runtime updates (Abhishek Rawal) [RHEL-216700] {CVE-2025-38004} - smb: client: fix double-free in SMB2_close() replay (Paulo Alcantara) [RHEL-240056] {CVE-2026-64597} - selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-132852] - selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-132852] {CVE-2026-43084} - netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-132852] - netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-132852] - ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (Abhishek Rawal) [RHEL-228009] {CVE-2026-53075} - vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231711] {CVE-2026-63993} - ipv6: sit: reload inner IPv6 header after GSO offloads (Abhishek Rawal) [RHEL-225920] {CVE-2026-53228} - ipv6: add NULL checks for idev in SRv6 paths (Abhishek Rawal) [RHEL-218012] {CVE-2026-23442} - nvmet-auth: validate reply message payload bounds against transfer length (CKI Backport Bot) [RHEL-234153] {CVE-2026-64319} - KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU (CKI Backport Bot) [RHEL-234204] {CVE-2026-64287} - KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CKI Backport Bot) [RHEL-229347] {CVE-2026-53277} - ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CKI Backport Bot) [RHEL-227269] {CVE-2026-64002} - io_uring/poll: fix signed comparison in io_poll_get_ownership() (CKI Backport Bot) [RHEL-227111] {CVE-2026-52933} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098} - nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129} - rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027] - rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027] - wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409} - wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193} - wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307} - wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255} - wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117} - wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037} - wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182} - net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947} - wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515} - Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072} - accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051} - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947} - Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123} - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209} - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944} - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975} - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946} - ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113} - Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334} - vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042} - security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015} - Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254} - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256} - Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918} - xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091} - vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322} - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - gve: update QPL page registration logic to honor max_registered_pages (backport from upstream) - gve: enable reading max ring size from the device in DQO-QPL mode (backport from upstream) - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890] - arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890] - iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890] - iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890] - iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890] - iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890] - iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890] - iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890] - iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890] - iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890] - iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890] - iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890] - iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890] - iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890] - iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890] - iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890] - dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890] - dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890] - dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890] - i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890] - i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890] - i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890] - i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890] - i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890] - redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233] - iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233] - iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233] - iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233] - iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233] - iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233] - iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233] - iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233] - iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233] - iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233] - iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233] - iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233] - iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233] - iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233] - iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233] - iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233] - iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233] - iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233] - iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731] - watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348] - smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559] - smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559] - smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559] - smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559] - smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559] - smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559] - smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559] - smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559] - smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559] - smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559] - smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559] - smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559] - smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539} - scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556} - drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466} - drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370} - drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368} - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656} - drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566} - drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479} - drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466} - drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264} - mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035] - mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035] - mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035] - mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035] - mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035] - mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035] - mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035] - mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035] - mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035] - mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035] - mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035] - mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035] - mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035] - mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035] - mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035] - xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663} - xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919} - xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426} - xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239} - ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917} - ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921} - af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361} - af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394} - af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544] - af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544] - af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544] - af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544] - af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544] - af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544] - af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544] - af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544] - af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544] - af_unix: Sort headers. (Davide Caratti) [RHEL-227544] - unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544] - af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544] - sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194] - sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246} - scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745} - lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111} - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149} - netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131} - scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889} - scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149} - sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924} - vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518] - hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518] - hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518] - hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518] - hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518] - hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518] - wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363} - wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175} - wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176} - net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172} - wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869} - smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105] - time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225] - clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519] - configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519] - clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519] - arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519] - ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519] - clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519] - redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516] - arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516] - nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516] - dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516] - octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045} - octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923} - dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102} - net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143} - net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294} - ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776] - ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128} - ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200} - netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414} - net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971} - ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192} - ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029} - ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193} - hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456} - IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176} - soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534} - mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518} - redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517] - arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517] - pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517] - pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517] - libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159} - Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188} - libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155} - redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478] - redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478] - redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478] - redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471] - iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945} - iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944} - iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894} - Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391} - net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293} - dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062} - crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959} - keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844} - scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846} - netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569} - redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788] - watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788] - usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788] - usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788] - usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788] - usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788] - rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788] - mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788] - i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788] - i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788] - i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788] - i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788] - gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788] - gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788] - gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788] - gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788] - gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788] - gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788] - gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243} - smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383} - RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007} - block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638] - block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053} - blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802} - bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283] - ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201} - sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564} - mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831} - sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247] - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266} - module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298] - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121} - nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481} - af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005} - af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262] - ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714} - drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108} - drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257} - drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266} - drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098} - drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311} - drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273} - drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267} - drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290} - drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316] - drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230} - drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204} - fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323} - drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199} - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331] - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331] - accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203} - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285} - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136} - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990} - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984} - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - bnxt_en: fix DMA mapping length for padded small packets - ceph: give up on paths longer than PATH_MAX {CVE-2024-53685} - ceph: fix memory leaks in ceph_mdsc_build_path() {CVE-2026-43419} - ceph: add a bunch of missing ceph_path_info initializers {CVE-2026-43408} - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - net: always dissect GSO packets in __virtio_net_hdr_to_skb() (Davide Caratti) [RHEL-280590] - ipv4: validate checksum_start before completing checksum (CKI Backport Bot) [RHEL-280590] {CVE-2026-99999} - signal: Prevent exec() race (Phil Auld) [RHEL-282048] {CVE-2026-98256} - posix-timers: Target group sigqueue to current task only if not exiting (Phil Auld) [RHEL-282048] - exec: Cleanup POSIX timers right after de_thread() (Luiz Capitulino) [RHEL-282070] {CVE-2026-98260} - smb: client: reject a tree connect response whose byte count is too small (CKI Backport Bot) [RHEL-271291] {CVE-2026-89631} - smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2() (Frank Sorenson) [RHEL-271484] {CVE-2026-89633} - xfrm: espintcp: fix UAF during close (CKI Backport Bot) [RHEL-256678] - xfrm: nat_keepalive: avoid double free on send error (CKI Backport Bot) [RHEL-256678] - xfrm: Check for underflow in xfrm_state_mtu (CKI Backport Bot) [RHEL-256678] - xfrm: route MIGRATE notifications to caller's netns (CKI Backport Bot) [RHEL-256678] - drivers/hv: remove deposited pages from direct map (Paolo Bonzini) [RHEL-267038] - selftests/mm: hugepage-mremap: fix mapping alignment (Luiz Capitulino) [RHEL-181987] - sctp: validate cookie AUTH state before use (Xin Long) [RHEL-254315] {CVE-2026-74752} - sctp: stop processing a packet once its association is deleted (Xin Long) [RHEL-254315] {CVE-2026-89479} - sctp: avoid auth_enable sysctl UAF during netns teardown (Xin Long) [RHEL-258778] {CVE-2026-68162} - sctp: keep chunk->transport in step with the list it is queued on (Xin Long) [RHEL-254353] {CVE-2026-74588} - usb: typec: ucsi: validate connector number in ucsi_connector_change() (Desnes Nunes) [RHEL-259412] {CVE-2026-63958} - usb: typec: ucsi: displayport: NAK DP_CMD_CONFIGURE without a payload VDO (Desnes Nunes) [RHEL-259412] - usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes() (Desnes Nunes) [RHEL-259412] {CVE-2026-63962} - usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers (Desnes Nunes) [RHEL-259412] {CVE-2026-63963} - usb: typec: altmodes/displayport: validate count before reading Status Update VDO (Desnes Nunes) [RHEL-259412] {CVE-2026-63961} - redhat/configs: automotive: enable USB_CHIPIDEA_IMX (Jared Kangas) [RHEL-257228] - Bluetooth: hci_sync: Fix advertising data UAFs (CKI Backport Bot) [RHEL-254672] {CVE-2026-74509} - openvswitch: vport: fix self-deadlock on release of tunnel ports (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - openvswitch: defer tunnel netdev_put to RCU release (CKI Backport Bot) [RHEL-253867] {CVE-2026-31678} - tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228912] {CVE-2026-63801} - tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238046] {CVE-2026-68117} - sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229479] {CVE-2026-63971} - sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231579] {CVE-2026-52917} - sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236158] {CVE-2026-68315} - sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237097] {CVE-2026-68376} - sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237097] {CVE-2026-68300} - s390/ap: Restrict driver_override versus apmask and aqmask use (Ramesh Chhetri) [RHEL-245336] - s390/ap: Rename mutex ap_perms_mutex to ap_attr_mutex (Ramesh Chhetri) [RHEL-245336] - s390/ap: Support driver_override for AP queue devices (Ramesh Chhetri) [RHEL-245336] - s390/ap: Use all-bits-one apmask/aqmask for vfio in_use() checks (Ramesh Chhetri) [RHEL-245336] - xfrm: espintcp: do not reuse an in-progress partial send (CKI Backport Bot) [RHEL-222980] {CVE-2026-52935} - net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271473] {CVE-2026-80985} - SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275057] {CVE-2026-93207} - svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275073] {CVE-2026-93228} - nfsd: don't free session slots that are still in use (Olga Kornievskaia) [RHEL-270850] {CVE-2026-89689} - NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270946] {CVE-2026-90036} - NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270946] {CVE-2026-89659} - svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271459] {CVE-2026-89526} - ice: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: send MAC change request synchronously (Jose Ignacio Tornos Martinez) [RHEL-143410] - i40e: skip unnecessary VF reset when setting trust (Jose Ignacio Tornos Martinez) [RHEL-143410] - iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test (Jose Ignacio Tornos Martinez) [RHEL-143410] - media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262501] {CVE-2026-89894} - ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261677] {CVE-2026-72262} - net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260529] {CVE-2026-68140} - wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (CKI Backport Bot) [RHEL-259554] {CVE-2026-64030} - USB: serial: cypress_m8: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63956} - USB: serial: safe_serial: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63957} - USB: serial: omninet: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63928} - USB: serial: mxuport: fix memory corruption with small endpoint (Desnes Nunes) [RHEL-259316] {CVE-2026-63899} - netfilter: nfnetlink_queue: do shared-unconfirmed check before segmentation (Phil Sutter) [RHEL-230721] {CVE-2026-45859} - ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256452] {CVE-2026-74641} - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() (CKI Backport Bot) [RHEL-254620] {CVE-2026-74574} - idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243402] {CVE-2026-68291} - idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243402] {CVE-2026-53286} - idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243402] {CVE-2026-64162} - idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243402] {CVE-2026-31647} - Bluetooth: hci_core: Fix queuing tx_work after workqueue is drained (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (CKI Backport Bot) [RHEL-244763] {CVE-2026-63974} - net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-240917] {CVE-2026-68377} - bridge: mcast: Fix a possible use-after-free when removing a bridge port (CKI Backport Bot) [RHEL-232531] {CVE-2026-64032} - net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229655] {CVE-2026-46319} - net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226492] {CVE-2026-53011} - ionic: convert to ndo_hwtstamp API (CKI Backport Bot) [RHEL-165657] - nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276363] {CVE-2026-89970} - thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226827] {CVE-2026-43332} - bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273900] {CVE-2026-64507} - bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273875] {CVE-2026-64508} - tls: Preserve sk_err across recvmsg() when data has been copied (Valentin Schneider) [RHEL-275027] - net: tls: prevent chain-after-chain in plain text SG (Valentin Schneider) [RHEL-275027] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Valentin Schneider) [RHEL-275027] - net: tls: fix silent data drop under pipe back-pressure (Valentin Schneider) [RHEL-275027] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Valentin Schneider) [RHEL-275027] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Valentin Schneider) [RHEL-275027] - tls: Purge async_hold in tls_decrypt_async_wait() (Valentin Schneider) [RHEL-275027] - tls: Fix race condition in tls_sw_cancel_work_tx() (Valentin Schneider) [RHEL-275027] - af_unix: Unlink scc_entry in unix_del_edge(). (CKI Backport Bot) [RHEL-270654] {CVE-2026-80521} - openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263802] {CVE-2026-68123} - macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226678] {CVE-2026-63925} - cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261989] {CVE-2026-72318} - smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259796] {CVE-2026-64385} - KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252479] {CVE-2026-72289} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232114] {CVE-2026-64191} - ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-273805] - ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-273805] - ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-273805] - ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-273805] - udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268127] {CVE-2026-74705} - nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264930] {CVE-2026-89690} - svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187745] {CVE-2026-89530} - nfsd: fix stale s2s_cp_stateids IDR entry for async COPY (Roberto Bergantinos Corpas) [RHEL-264798] {CVE-2026-89676} - nfsd: fix UAF in async copy cancel and shutdown (Roberto Bergantinos Corpas) [RHEL-264749] {CVE-2026-89675} - nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264168] {CVE-2026-89669} - nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264134] {CVE-2026-89663} - nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264134] - nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264134] - NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259243] {CVE-2026-53398} - SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261492] {CVE-2026-72317} - vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254268] - macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254268] - ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254268] {CVE-2026-74744} - ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246118] {CVE-2026-23103} - vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229037] {CVE-2026-63970} - vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232860] {CVE-2026-53365} - KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192289] {CVE-2026-53360} - vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232273] {CVE-2026-64115} - mlxbf-bootctl: use sysfs_emit_at() in secure_boot_fuse_state_show() (CKI Backport Bot) [RHEL-212709] - mlxbf-bootctl: Support sysfs entries for RTC battery status (CKI Backport Bot) [RHEL-212709] - platform/mellanox: mlxbf-bootctl: use sysfs_emit() instead of sprintf() (CKI Backport Bot) [RHEL-212709] - igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227035] {CVE-2026-64035} - netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288} - tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024} - Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275} - nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227} - nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972} - s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888] - ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132} - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417} - crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972} - wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457] - wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457] - wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457] - crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457] - futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003} - futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469] - futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775} - futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778} - futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758} - futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776} - futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658} - futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469] - compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469] - ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476} - ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792} - ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924} - ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922} - ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984} - ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920} - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557} - l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918} - tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992} - tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994} - vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432} - net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052} - net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829} - Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357} - netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320} - KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921} - KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516} - ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669} - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255} - netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394] - netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078} - netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394] - netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394] - netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394] - netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746} - packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537] - packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582} - net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537] - RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856} - netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860} - ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270} - KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794} - dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099} - net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034} - gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261] - gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261] - gve: Use generic power management (Michal Schmidt) [RHEL-219261] - gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261] - gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261] - gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261] - gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261] - gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261] - gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261] - gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261] - gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261] - gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261] - gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261] - gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261] - net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261] - gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261] - gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261] - gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261] - gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261] - gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261] - gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261] - gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261] - gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261] - gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261] - gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261] - gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261] - gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261] - gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261] - gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261] - gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261] - gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261] - gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261] - gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261] - gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261] - gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261] - gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261] - gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261] - gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261] - gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261] - gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261] - gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261] - gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261] - gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261] - gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261] - gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261] - gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261] - gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261] - gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261] - gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261] - gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261] - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261] - gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261] - gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261] - gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261] - gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261] - gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261] - gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261] - gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261] - gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261] - gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261] - gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261] - gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261] - gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261] - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261] - gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261] - gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261] - gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261] - gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261] - gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261] - gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261] - gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261] - gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261] - gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261] - gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261] - gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261] - gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261] - gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261] - gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261] - perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753} - perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556} - perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496] - KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775} - KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317} - nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480} - x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402] - fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341} - crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522} - vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299} - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661] - KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076} - ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942} - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618] - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618] - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618] - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618] - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618] - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618] - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674] - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek) - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908] - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367] - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800] - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714] - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521] - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521] - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (refresh to upstream v5: now also covers skb_segment() and tcp_clone_payload(); CVE-2026-46300 "Fragnesia") - smb: client: reject userspace cifs.spnego descriptions (upstream commit 3da1fdf4efbc) - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (CVE-2026-46300 "Fragnesia") - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) - Debrand for AlmaLinux OS - Use AlmaLinux OS secure boot cert - Enable Btrfs support for all kernel variants - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - crypto: scatterwalk - Backport memcpy_sglist() - crypto: algif_aead - use memcpy_sglist() instead of null skcipher - crypto: algif_aead - Revert to operating out-of-place - crypto: algif_aead - snapshot IV for async AEAD requests - crypto: authenc - use memcpy_sglist() instead of null skcipher - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authencesn - Fix src offset when decrypting in-place - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 - qla4xxx: bring back deprecated PCI ids - be2iscsi: bring back deprecated PCI ids - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained - Set version to 6.12.0-211.7.1.el10_2 (Andrew Lukoshko) - kabi: enable check-kabi (Čestmír Kalina) - kabi: add symbols to stablelist (Čestmír Kalina) - Merge tag 'kernel-6.12.0-211.7.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.6.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.5.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.4.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.3.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.2.1.el10_2' into main (Scott Weaver) - Merge tag 'kernel-6.12.0-211.1.1.el10_2' into main (Scott Weaver) - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673] - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053] - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053] - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270] - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415] - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415] - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171} - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191} - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441] - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243} - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546] - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278] - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040} - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936] - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936] - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156} - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265] - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722] - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722] - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461] - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461] - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461] - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461] - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461] - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461] - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210} - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204} - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408] - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144} - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323] - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323] - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632] - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632] - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632] - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632] - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632] - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632] - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632] - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632] - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632] - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632] - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632] - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632] - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632] - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632] - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632] - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632] - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632] - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632] - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632] - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632] - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632] - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632] - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632] - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632] - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632] - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632] - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632] - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632] - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632] - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632] - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632] - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632] - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353] - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700] - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231} - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111} - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231] - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209} - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652] - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652] - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815] - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815] - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097} - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Switch to use Kyoto Cabinet - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.8.1 - bug fixes - Update to 2.8.0 - bug fixes for ARMv7 - Rebuild (qt6) Resolves: RHEL-109197 - Rebuild (qt6) Resolves: RHEL-95936 - Update to 0.9.0 Resolves: RHEL-72805 - Rebuild (qt6) Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.8.1 and build Qt 6 bindings Resolves: RHEL-60817 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild (qt6) Resolves: RHEL-109197 - Rebuild (qt6) Resolves: RHEL-95936 - Update to 0.9.0 Resolves: RHEL-72805 - Rebuild (qt6) Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.8.1 and build Qt 6 bindings Resolves: RHEL-60817 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild (qt6) Resolves: RHEL-109197 - Rebuild (qt6) Resolves: RHEL-95936 - Update to 0.9.0 Resolves: RHEL-72805 - Rebuild (qt6) Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.8.1 and build Qt 6 bindings Resolves: RHEL-60817 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild (qt6) Resolves: RHEL-109197 - Rebuild (qt6) Resolves: RHEL-95936 - Update to 0.9.0 Resolves: RHEL-72805 - Rebuild (qt6) Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.8.1 and build Qt 6 bindings Resolves: RHEL-60817 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild (qt6) Resolves: RHEL-109197 - Rebuild (qt6) Resolves: RHEL-95936 - Update to 0.9.0 Resolves: RHEL-72805 - Rebuild (qt6) Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.8.1 and build Qt 6 bindings Resolves: RHEL-60817 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml - Update to 0.5.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Install a versioned library symlink (#2247508) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.5.3 - Update to 0.5.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add cracklib dependency (RHEL-39973) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Use setuptools instead of distutils to build this package - Resolves: rhbz#2165572 - Strengthen cracklib-dicts dependency to Recommends (#2158891) - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - update to 0.14.0 - fix rpminspect rpmdeps - fix gating-yaml-checks Related: RHEL-31259 - Resolves: RHEL-31259, Conditionally enable SSL engine APIs - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - fix security issue, CVE-2023-35789 - update to 0.13.0 - drop patches merged upstream - update to 0.12.0 - add patch to not install the static library, from https://github.com/alanxz/rabbitmq-c/pull/749 - add patch to fix version in pkgconfig file, from https://github.com/alanxz/rabbitmq-c/pull/751 - Resolves: RHEL-266738, CVE-2026-44236 Heap buffer overflow leading to denial of service - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Add support for riscv64 - gcc-14 - ceph-18.2.1, incorporate changes from *final* 18.2.1 release from https://download.ceph.com/rpm-18.2.1/el9/SRPMS/ceph-18.2.1-0.el9.src.rpm - ceph-18.2.1 GA - ceph-18.2.0 GA - ceph-18.1.3 RC4, rebuild with libarrow-13.0.0 - ceph-18.1.3 RC4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - revert python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - with python3-Cython -> python3dist(cython) < 3~~ - Rebuilt for ICU 73.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Disable building with openssl engine support resolves: RHEL-33739 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebase to latest upstream version resolves: rhbz#1947184 - Update License tag for SPDX - Upstream sources claim that the Apache 2.0 is used - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild Resolves: RHEL-54298 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - rebase to 1.11.0 resolves: rhbz#2159703 - enable openssl - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to 1.19.0 (RHEL-126292) - Test for: Fix input termination for pgpParsePkts (RHEL-61730) - Fix input termination for pgpParsePkts Resolves: RHEL-82533 - Propagate return value from prepare_repo_download_targets (RHEL-85338) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Use librpmio instead of gpgme for handling PGP keys (RHEL-47106) - Fix a memory leak in select_next_target() (RHEL-35699) - Update to 1.18.0 (RHEL-35699) - API: Add LRO_USERNAME and LRO_PASSWORD options - Add a private dependency on zck to librepo.pc if zchunk support is enabled - Hash cache: Improved work with extended file attributes - Improve performance of large number of package downloads - Fix error handling, Fix examples and build them - Bump release for June 2024 mass rebuild - Update to 1.17.1 (RHEL-38831) - gpg_gpgme.c: fix build errors with older gcc - Change header files to match a configured ABI regarding a zchunk support - Fix building zchunk code if zchunk is enabled - Fix compiler warnings - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Improve a documentation (RHEL-38831) - Refactor parse_entitlement_data() (RHEL-32365) - Fix relocating certificate paths to /etc/rhsm-host (RHEL-37866) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert a license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use new lockdown-compatible ABI when available - Add plan for CI test Resolves: RHEL-101976 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-31935, update to 2.0.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Backport packaging of mock service from Fedora in order to consume it in EPEL Resolves: RHEL-81780 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix SDPX license - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use GnuTLS as the default crypto backend - Update to 0.21.2 - Update to 0.21.1 - Update to 0.21.0 - SELinux userspace 3.10 release - restorecon: Add option to count relabeled files (RHEL-144056) - Rebuild to accomodate changes in swig (RHEL-118812) - Ignore files removed during relabeling (RHEL-110181) - SELinux userspace 3.9 release - SELinux userspace 3.9-rc2 release - Prioritize local literal fcontext definitions (rhbz#2360183) - SELinux userspace 3.8 release - SELinux userspace 3.8-rc3 release - libselinux/utils: drop reachable assert in sefcontext_compile - SELinux userspace 3.10 release - Rebuild to accommodate changes in swig (RHEL-138405) - SELinux userspace 3.9 release - SELinux userspace 3.9-rc2 release - SELinux userspace 3.8.1 release - improve performance of semanage store rebuild (RHEL-81707) - SELinux userspace 3.8 release - SELinux userspace 3.8-rc3 release - SELinux userspace 3.8-rc1 release - direct_api: INTEGER_OVERFLOW read_len = read() (RHEL-35997) - Bump release for October 2024 mass rebuild (RHEL-64018) - SELinux userspace 3.10 release - SELinux userspace 3.9 release - SELinux userspace 3.9-rc2 release - SELinux userspace 3.8 release - SELinux userspace 3.8-rc3 release - SELinux userspace 3.8-rc1 release - cil: Check that sym_index is within bounds (RHEL-34823) - cil: Initialize avtab_datum on declaration (RHEL-34810) - mls: Do not destroy context on memory error (RHEL-34810) - cil/cil_post: Initialize tmp on declaration (RHEL-34810) - Initialize "strs" on declaration (RHEL-34810) - Bump release for October 2024 mass rebuild (RHEL-64018) - sepol_compute_sid: Do not destroy uninitialized context (RHEL-34808) - SELinux userspace 3.7 release - Manual creation of users and groups for old release Resolves: RHEL-86305 - Add sysusers.d config file to allow rpm to create users/groups automatically Resolves: RHEL-86305 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.4.328.1 SDK - Update to SDK v1.4.313.0 - Update to 1.4.304.0 SDK - Bump release for October 2024 mass rebuild: - Update to 1.3.280.0 SDK - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fixed devel subpackage SPDX license Related: RHEL-35719 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Converted license tag to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update libshout to 2.4.6 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.6.0 - Fix NEWS file to not be executable - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.6.0 - Fix NEWS file to not be executable - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Backport "ip: Enforce strict aliasing" patch - Fixes: RHEL-40593 - rebuild - Related: RHEL-39410 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - use sysuser setting for uuidd - Fix heap buffer overread in setpwnam() [CVE-2025-14104] - libfdisk: fix off-by-one in maximum last sector calculation - mount: improve --all documentation - libblkid: Fix probe_ioctl_tp assigning BLKGETDISKSEQ as physical - libblkid: use snprintf() instead of sprintf() - lscpu: Add NVIDIA Olympus arm64 core - libfdisk: improve collision reporting - libfdisk: (dos) ignore incomplete EBR for non-wholedisk - wall: always use utmp as fallback - lscpu: update table with ARM IDs - coresched: backport new tool to RHEL-10 - agetty: fix stdin conversion to tty name - blkid: allow up to 64k erofs block sizes - more(1): make sure we have data on stderr - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - apply patch for CVE-2026-37555 Resolves: RHEL-174531 - change the license to LGPL-2.1 OR LGPL-3.0 (#RHEL-85333) - fix crash in ogg vorbis (#RHEL-65092) (CVE-2024-50612) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - AlmaLinux changes: Set x86_64 arch as exchangeable to x86_64_v2 - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Bump release for June 2024 mass rebuild - Stricten dependencies between libsolv subpackages (RHEL-38831) - Configure gating - Set x86_64 arch as exchangeable to x86_64_v2 - Fix a buffer overflow when decompressing solv pages (CVE-2026-48864) (RHEL-178270) - Cope with integer overflow in data size arithmetics in repo_add_solv() (CVE-2026-9149) (RHEL-178267) - Fix a buffer overflow when copying SHA-384/512 checksum from a Debian repository (CVE-2026-9150) (RHEL-178263) - Add testcase for color filtering when adding update targets - Rebase to 0.7.33 - Run dnf CI-Tier-1 tests for gating of libsolv as well - Bump release for October 2024 mass rebuild: - Bump release for Aug 2024 perl mass rebuild - Use digest functions from OpenSSL - Add patches for CVE-2026-4271 and CVE-2026-5119 - Add patch for CVE-2026-1761 - Fix CVE-2026-0719 - Fix CVE-2025-14523 - Add patch for CVE-2025-12105 - Fix integer overflow in date/time parsing - Bump revision number - Fix several CVEs - Add patch to hopefully fix http2-body-size-test timeouts - Add patch to hopefully fix server-test timeouts - Fix CVE-2026-85197: http2 crash after connection destroyed - Fix CVE-2026-15711: Reject oversized WebSocket control frames - Fix CVE-2026-15709: bound decompressed WebSocket message size - Add patches for CVE-2026-4271 and CVE-2026-5119 - Add patch for CVE-2026-1761 - Fix CVE-2026-0719 - Fix CVE-2025-14523 - Add patch for CVE-2025-12105 - Fix integer overflow in date/time parsing - Bump revision number - CVE-2026-102557 libsoup3: libsoup: Heap buffer overflow during WebSocket message reassembly - CVE-2026-102556 libsoup3: libsoup: Heap buffer overflow from WebSocket Pong signal type confusion - CVE-2026-102558 libsoup3: libsoup: Heap buffer overflow during WebSocket receive-buffer growth - CVE-2026-102555 libsoup3: libsoup: Heap buffer overflow via uninitialized length in data-URI base64 decoding - CVE-2026-102560 libsoup3: libsoup: Heap buffer overflow during outgoing permessage-deflate buffer growth - CVE-2026-102559 libsoup3: libsoup: Heap buffer overflow during WebSocket client-frame masking - Fix CVE-2026-85197: http2 crash after connection destroyed - Fix CVE-2026-15711: Reject oversized WebSocket control frames - Fix CVE-2026-15709: bound decompressed WebSocket message size - Add patches for CVE-2026-4271 and CVE-2026-5119 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild for ghostscript-10.0.0 - Related: #2128814 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.2.12 - Resolves: #2159146 - Update to 0.2.11 - Resolves: #2139968 - Update libspelling 0.4.8 - Update to 0.4.6 - Initial import based on Fedora 42 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - add %check (thanks to Gerd v. Egidy) Related: rhbz#2163492 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in eval_access_token_buf() - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified - Resolves: RHEL-148232 - Failed to resolve indirect group-members of nested non-POSIX group - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2 - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000] - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none' - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4 - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c' - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2] - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name. - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Resolves: RHEL-72935 - sss_override does not work on AD UPN - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD] - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication) - Related: RHEL-114545 - Rebase Samba to the latest 4.23.x release - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted. - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache - Related: RHEL-89870 - Rebase Samba to the latest 4.22.x release - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1 - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack - Resolves: RHEL-25593 - Improve sssd-simple man page description - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem - Resolves: RHEL-4981 - p11_child currently has an infinite timeout - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names - Resolves: RHEL-89474 - Fails to build on riscv64 - Change to almalinux bugtracker - Set --with-arch_64=x86-64-v2 on v2 arch - Fix sysroot packages for i686 architecture - fixes for testing non-production cross compilers (RHEL-114521) - include libsanitizer.spec and static sanitizer libraries in packages - enable tests involving target environment variables in cross testing - disable color for more sanitizer tests - fixes for testing non-production cross compilers (RHEL-114521) - enable guality tests in cross testing - enable simulate-thread tests in cross testing - enable gcov tests in cross testing - enable some miscellaneous tests in cross testing - fix some tree-prof tests for cross testing - fixes for testing non-production cross compilers (RHEL-114521) - enable stack-protector tests in cross testing - fixes for testing non-production cross compilers (RHEL-114521) - include libstdc++fs.a and libstdc++exp.a in sysroot packages - add libsanitizer sysroot packages - save testsuite .sum files in build logs - add packages with files from build tree used in testsuite - escape \r in dg-regexp test names to avoid truncation in build-tree testing - fix iconv linking for installed testing - enable compat testing for installed testing - distinguish canonical and noncanonical target for installed testing - add plugin headers packages for cross compilers - install text-art/*.h plugin headers - support plugin tests for installed testing - update from releases/gcc-14 branch - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620, c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092, fortran/120784, fortran/121145, fortran/121263, go/104290, libstdc++/110853, libstdc++/117276, libstdc++/120698, libstdc++/121097, libstdc++/121374, libstdc++/121496, libstdc++/121745, libstdc++/121827, libstdc++/122168, libstdc++/122322, middle-end/121453, middle-end/121828, other/118919, rtl-optimization/121253, target/49857, target/81540, target/118280, target/120442, target/120476, target/120691, target/121118, target/121208, target/121294, target/121414, target/121449, target/121542, target/121599, target/121608, target/121749, target/122177, target/122187, target/122210, target/122220, target/122222, testsuite/118567, tree-optimization/117423, tree-optimization/119085, tree-optimization/120357, tree-optimization/120358, tree-optimization/120654, tree-optimization/120817, tree-optimization/120944, tree-optimization/121059, tree-optimization/121256, tree-optimization/121370, tree-optimization/121772, tree-optimization/121870, tree-optimization/122104 - add sysroot packages for use by non-production cross compilers (RHEL-118680) - add cross compilers for aarch64, ppc64le and s390x for non-production uses (RHEL-114519) - Add branch, conditions, and calls to gcov function summaries (RHEL-105464) - Update to latest pretty printers from GTS (RHEL-81976) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove smis plugin sub package - Add gating.yaml - Upgrade to 1.10.1 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Fix erroneous my_strncat implementation Resolves: RHEL-83778 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory leaks and off-by-one error Resolves: RHEL-42557 - Rebuild - Bump release - Add explicit package version requirement for sysfsutils requiring libsysfs - Bump release for June 2024 mass rebuild - Update license tags to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 2.4.3 - resolves: RHEL-89875 - Reformat - Bump release for June 2024 mass rebuild - rhbz#2260954 - libtalloc-2.4.2 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - rhbz#2224330 - libtalloc-2.4.1 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to version 1.4.14 - resolves: RHEL-114546 - Update to version 1.4.13 - resolves: RHEL-89874 - Enable gating tests for libtdb - resolves: RHEL-34923 - Update to version 1.4.12 - resolves: RHEL-59782 - rhbz#2300485 - libtdb-1.4.11 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Rebuilt for Python 3.13 - Cleanup spec file - rhbz#2260955 - libtdb-1.4.10 is available - Update to version 0.17.1 - resolves: RHEL-114547 - Update to version 0.16.2 - resolves: RHEL-89876 - Reformat - Bump release for June 2024 mass rebuild - rhbz#2260956 - libtevent-0.16.1 is available - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to version 0.16.0 - resolves: rhbz#2244376 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Remove transfig dependency for RHEL - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148253) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112523) - drop unused compat libtiff.so.5 (RHEL-85372) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52926) - Bump release for June 2024 mass rebuild - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374) - make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281) - reintroduce ignore option -i as it is required for tests (RHEL-185328) - backport documentation change for CVE-2023-52355 (RHEL-178281) - fix CVE-2026-4775: signed integer overflow in putcontig8bitYCbCr44tile (RHEL-159310) - fix CVE-2023-52356: libtiff could crash in TIFFReadRGBATileExt when parsing crafted tiff file (RHEL-148253) - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112523) - drop unused compat libtiff.so.5 (RHEL-85372) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2024-7006 a null pointer dereference in tif_dirinfo (RHEL-52926) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Updated to the latest upstream release: libtirpc-1_3_5 (RHEL-50728) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Updated to the latest upstream RC release: libtirpc-1-3-5-rc2 - Updated to the latest upstream RC release: libtirpc-1-3-5-rc1 - Convert License tag to SPDX format - Updated to latest upstream release: libtirpc-1-3-4 - Updated to the latest upstream RC release: libtirpc-1-3-4-rc2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rework hardening patch to include loaders. (RHEL-33501) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - bump: for gcc 14.* in rawhide - Migrate to SPDX licenses (#2222091). - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - bump: for gcc 13.* in rawhide - C99 compatibility fix in the testsuite - Bump release (RHEL-66937) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to version 0.23.0 (RHEL-56996) - Bump release for June 2024 mass rebuild - Update to version 0.20.9 https://github.com/tree-sitter/tree-sitter/releases/tag/v0.20.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 0.20.8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - AlmaLinux changes: Enable Btrfs support - Disable LSM module for i686 architecture - Version 2.11.0 (RHEL-114981) - tests: Rework nvme revision check (RHEL-90572) - tests: Adapt for missing fstab and crypttab (RHEL-78987) - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109406) - mdraid: Avoid acquiring system inhibit lock for external array operations (RHEL-74012) - Rebase to upstream 2.10.90 (pre-)release - lvm2: Try opening for unused device detection harder (RHEL-39935) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix Requires: for modules - Fix gating tests - Rebase to git snapshot as of 2024-07-25 - Bump release for June 2024 mass rebuild - AlmaLinux changes: Enable Btrfs support - Disable LSM module for i686 architecture - Rework fstab mount authorization for as-user (CVE-2026-7867) (RHEL-173437) - Add missing polkit check for RestoreEncryptedHeader() (CVE-2026-26103) (RHEL-148566) - Add missing polkit check for HeaderBackup() (CVE-2026-26104) (RHEL-148590) - Version 2.11.0 (RHEL-114981) - tests: Rework nvme revision check (RHEL-90572) - tests: Adapt for missing fstab and crypttab (RHEL-78987) - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109406) - mdraid: Avoid acquiring system inhibit lock for external array operations (RHEL-74012) - Rebase to upstream 2.10.90 (pre-)release - lvm2: Try opening for unused device detection harder (RHEL-39935) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - AlmaLinux changes: Enable Btrfs support - Disable LSM module for i686 architecture - Add missing polkit check for RestoreEncryptedHeader() (CVE-2026-26103) (RHEL-148566) - Add missing polkit check for HeaderBackup() (CVE-2026-26104) (RHEL-148590) - Version 2.11.0 (RHEL-114981) - tests: Rework nvme revision check (RHEL-90572) - tests: Adapt for missing fstab and crypttab (RHEL-78987) - udiskslinuxmanager: Add lower bounds check to fd_index (CVE-2025-8067) (RHEL-109406) - mdraid: Avoid acquiring system inhibit lock for external array operations (RHEL-74012) - Rebase to upstream 2.10.90 (pre-)release - lvm2: Try opening for unused device detection harder (RHEL-39935) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix Requires: for modules - Fix gating tests - Rebase to git snapshot as of 2024-07-25 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - adding gating.yaml configuration - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Specify the soname explicitly - Update to upstream 1.1 release - Update liburing to enable newest kernel features. - Resolves: RHEL-111527 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to liburing 2.5. - create temporary edit files at symlink target location (RHEL-85247) - rebuild, fix FTBFS (#RHEL-65455) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add additional SPDX licenses found by scancode tool - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change the License tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: license is already SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Enable building for ppc64le - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - Enable building for ppc64le - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242547) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242547) - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242547) - qemu: Remove 'allowReboot' field (RHEL-242547) - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242547) - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242547) - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242547) - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242547) - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242547) - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242547) - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242547) - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242547) - Add support for keeping VM running when panic notifier is used (RHEL-242547) - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-224982) - Add guest device info to virDomainGetGuestInfo (RHEL-243305) - qemu_agent: Introduce guest-get-devices (RHEL-243305) - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243305) - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243305) - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243305) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224982) - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622) - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-186019) - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-186019) - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-186019) - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-186019) - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-186019) - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-186019) - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-186019) - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-186019) - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-186019) - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-186019) - conf: Add fields for recording actually-selected virtio video device (RHEL-186019) - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-186019) - qemuDeviceVideoGetModel: Directly return picked model (RHEL-186019) - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-186019) - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-186019) - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-186019) - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-186019) - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-186019) - vmx: Generate correct disk target device ID for superwide SCSI (RHEL-191267) - vmx: Fix a case with 64 disks on one SCSI controller (RHEL-191267) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - Enable building for ppc64le - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-143933) - qemu: Implement support for associating iommufd to hostdev (RHEL-126346, RHEL-74202) - qemu: Introduce privateData for hostdevs (RHEL-126346, RHEL-74202) - qemu: Support per-process memory accounting for iommufd (RHEL-126346, RHEL-74202) - qemu: open VFIO FDs from libvirt backend (RHEL-126346, RHEL-74202) - qemu: open iommufd FD from libvirt backend (RHEL-126346, RHEL-74202) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126346, RHEL-74202) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126346, RHEL-74202) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145769) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145769) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145769) - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-141820) - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-141820) - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-141820) - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-141820) - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144089) - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144089) - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144089) - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144089) - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144089) - esx: Debug URL just before opening with curl (RHEL-138300) - esx: Abstract all URL-creation code into one function (RHEL-138300) - esx: Switch to creating URLs using virURIFormat (RHEL-138300) - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140196) - esx: URI encode inventory objects twice (RHEL-140196) - Enable building for ppc64le - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - Enable building for ppc64le - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242547) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242547) - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242547) - qemu: Remove 'allowReboot' field (RHEL-242547) - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242547) - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242547) - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242547) - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242547) - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242547) - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242547) - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242547) - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242547) - Add support for keeping VM running when panic notifier is used (RHEL-242547) - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-224982) - Add guest device info to virDomainGetGuestInfo (RHEL-243305) - qemu_agent: Introduce guest-get-devices (RHEL-243305) - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243305) - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243305) - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243305) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224982) - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622) - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-186019) - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-186019) - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-186019) - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-186019) - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-186019) - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-186019) - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-186019) - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-186019) - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-186019) - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-186019) - conf: Add fields for recording actually-selected virtio video device (RHEL-186019) - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-186019) - qemuDeviceVideoGetModel: Directly return picked model (RHEL-186019) - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-186019) - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-186019) - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-186019) - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-186019) - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-186019) - vmx: Generate correct disk target device ID for superwide SCSI (RHEL-191267) - vmx: Fix a case with 64 disks on one SCSI controller (RHEL-191267) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - Enable building for ppc64le - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-143933) - qemu: Implement support for associating iommufd to hostdev (RHEL-126346, RHEL-74202) - qemu: Introduce privateData for hostdevs (RHEL-126346, RHEL-74202) - qemu: Support per-process memory accounting for iommufd (RHEL-126346, RHEL-74202) - qemu: open VFIO FDs from libvirt backend (RHEL-126346, RHEL-74202) - qemu: open iommufd FD from libvirt backend (RHEL-126346, RHEL-74202) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126346, RHEL-74202) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126346, RHEL-74202) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145769) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145769) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145769) - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-141820) - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-141820) - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-141820) - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-141820) - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144089) - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144089) - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144089) - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144089) - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144089) - esx: Debug URL just before opening with curl (RHEL-138300) - esx: Abstract all URL-creation code into one function (RHEL-138300) - esx: Switch to creating URLs using virURIFormat (RHEL-138300) - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140196) - esx: URI encode inventory objects twice (RHEL-140196) - Enable building for ppc64le - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - Enable building for ppc64le - remote: Fix integer overflow in RPC handler for virNodeGetFreePages (CVE-2026-18917) (RHEL-245266, CVE-2026-18917) - qemu: Always assume support for 'QEMU_CAPS_SET_ACTION' (RHEL-242547) - qemu: Remove unused 'qemuProcessRebootAllowed' (RHEL-242547) - qemu: monitor: Remove support for 'watchdog-set-action' (RHEL-242547) - qemu: Remove 'allowReboot' field (RHEL-242547) - qemu: capabilities: Retire QEMU_CAPS_SET_ACTION (RHEL-242547) - qemuProcessSetupLifecycleActions: Prepare to handle other actions (RHEL-242547) - qemuDomainModifyLifecycleActionLive: Prepare to handle other actions (RHEL-242547) - processGuestPanicEvent: Don't pass panic action via parameter (RHEL-242547) - conf: Use proper enum types for 'onReboot', 'onPoweroff', 'onCrash', and 'onLockFailure' (RHEL-242547) - qemuMonitorGuestPanicEventInfoFormatMsg: Directly return message (RHEL-242547) - qemuProcessGuestPanicEventInfo: Fold into only caller (RHEL-242547) - qemu: processGuestPanicEvent: Split individual steps under separate conditions (RHEL-242547) - Add support for keeping VM running when panic notifier is used (RHEL-242547) - qemu: Fix proper ordering of 'virtlockd' shutdown (RHEL-224982) - Add guest device info to virDomainGetGuestInfo (RHEL-243305) - qemu_agent: Introduce guest-get-devices (RHEL-243305) - qemuagenttest: Introduce GetGuestDeviceInfo test case (RHEL-243305) - qemu: Implement device info for virDomainGetGuestInfo() API (RHEL-243305) - virsh: Add support for VIR_DOMAIN_GUEST_INFO_DEVICES (RHEL-243305) - qemu: Ensure proper shutdown ordering of virtlockd/virtlogd daemons (RHEL-224982) - util: virFileChownFiles: do not follow symlinks (CVE-2026-63622) - qemu: capabilities: Apply 'capability_filters' configration option on all capabilities (RHEL-186019) - qemu: capabilities: Export 'virQEMUCapsNewCopy' outside of 'qemu_capspriv' (RHEL-186019) - qemu: Allow reuse of 'qemuProcessStartUpdateCustomCaps' (RHEL-186019) - qemu: validate: Validate VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - qemu: postparse: Process VM config with qemuCaps influenced by <qemu:capabilities> (RHEL-186019) - virQEMUCapsCacheLookupDefault: Fix error message when no emulators are installed (RHEL-186019) - qemuxmlconfdata: un-symlink 'video-virtio-vga-gpu-gl' output (RHEL-186019) - qemuxmlconftest: Add 'video-virtio-vga' invocation with QEMU_CAPS_DEVICE_VIRTIO_VGA disabled (RHEL-186019) - qemuxmlconftest: Add test cases for configs asking for 'virtio-gpu-gl' or 'virtio-vga-gl' without the capability (RHEL-186019) - qemuxmlconftest: Add invocation of 'video-virtio-vga-gpu-gl' with missing caps and VIR_DOMAIN_DEF_PARSE_ABI_UPDATE (RHEL-186019) - qemustatusxml2xml: Add test case capturing virtio video device (RHEL-186019) - virDomainVideoDefFormat: Use 'virXMLFormatElement' instead of custom formatter (RHEL-186019) - conf: Add fields for recording actually-selected virtio video device (RHEL-186019) - qemuxmlconftest: Add test case for specifying 'virtio-gpu' where 'virtio-vga' would be picked (RHEL-186019) - qemuDeviceVideoGetModel: Directly return picked model (RHEL-186019) - qemu: postparse: Fill in selected virtio video frondend device in the XML (RHEL-186019) - qemuValidateDomainDeviceDefVideo: Fix checks of virtio video devices (RHEL-186019) - qemuDeviceVideoGetModel: Remove logic for selecting 'virtio' devices (RHEL-186019) - qemuDeviceVideoGetModel: Simplify by relying on checks from 'qemuValidateDomainDeviceDefVideo' (RHEL-186019) - qemu: Remove 'qemuDomainSupportsVideoVga' (RHEL-186019) - vmx: Generate correct disk target device ID for superwide SCSI (RHEL-191267) - vmx: Fix a case with 64 disks on one SCSI controller (RHEL-191267) - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-180449) - qemu_capabilities: Always sort features in host-model CPU (RHEL-180449) - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-180449) - qemu_capabilities: Cache expanded CPU (RHEL-180449) - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-180449) - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-180449) - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-180449) - cpu: Introduce virCPUUpdateFeatures (RHEL-180449) - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-180449) - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-180449) - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-180449) - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-180449) - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-180449) - distro: Replace old gating with tmt - esx: Track VMs by instanceUuid instead of UUID (RHEL-177479) - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154553) - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154553) - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154553) - docs: Clarify host-model description in domain capabilities (RHEL-154553) - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159912) - security: Cleanup hostdev label error logic (RHEL-159912) - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159912) - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159175) - conf: Move and rename virStorageSourceFDTuple object (RHEL-159175) - conf: Refactor virHostdevIsPCIDevice (RHEL-159175) - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159175) - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159175) - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159175) - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159175) - conf: Introduce domain iommufd element (RHEL-159175) - qemu: Implement iommufd (RHEL-159175) - conf: Add iommufd fdgroup support (RHEL-159175) - qemu: Implement iommufd fdgroup (RHEL-159175) - tests: Add iommufd fdgroup test (RHEL-159175) - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159175) - conf: Parse hyperv features even for host-model (RHEL-153576) - qemu: Wire up new hyperv host-model mode behavior (RHEL-153576) - Enable building for ppc64le - test: Default to ROM type for loader (RHEL-82645) - qemu_hotplug: Fix crash when attaching network inteface with hostdev network (RHEL-151916) - qemu_firmware: Drop support for kernel descriptors (RHEL-82645) - qemu_firmware: Drop 'nvram' local variable (RHEL-82645) - qemu_firmware: Move format=raw compat exception (RHEL-82645) - qemu_firmware: Move copying of nvram.format to loader.format (RHEL-82645) - tests: Add firmware-manual-efi-rw-nvram (RHEL-82645) - domain_validate: Reject NVRAM with read/write firmware (RHEL-82645) - tests: Add firmware-auto-bios-rw (RHEL-82645) - tests: Add firmware-manual-bios-rw (RHEL-82645) - domain_validate: Reject read/write ROMs (RHEL-82645) - tests: Add firmware-auto-efi-format-loader-qcow2-rom (RHEL-82645) - domain_validate: Reject ROMs with format other than raw (RHEL-82645) - qemu_firmware: Ignore stateless/combined when NVRAM is configured (RHEL-82645) - qemu_firmware: Drop fallback for absent nvramTemplateFormat (RHEL-82645) - schemas: Allow templateFormat without template path (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-format (RHEL-82645) - tests: Add firmware-manual-efi-nvram-template-nonstandard-legacy-paths (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-loader-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvram-raw-nvramtemplate-path (RHEL-82645) - tests: Add firmware-auto-efi-format-nvramtemplate-qcow2 (RHEL-82645) - tests: Add firmware-auto-efi-format-mismatch-nvramtemplate (RHEL-82645) - qemu_firmware: Introduce qemuFirmwareFillDomainCustom() (RHEL-82645) - qemu_firmware: Set templateFormat for custom paths (RHEL-82645) - qemu_firmware: Simplify handling of legacy paths (RHEL-82645) - qemu_firmware: Refactor setting NVRAM format (RHEL-82645) - qemu_firmware: Prefer template format to loader format (RHEL-82645) - qemu_firmware: Retain user-specified NVRAM format (RHEL-82645) - qemu_firmware: Take templateFormat into account when matching (RHEL-82645) - qemu_firmware: Take NVRAM format into account when matching (RHEL-82645) - qemu_firmware: Remove NVRAM to loader format copy hack (RHEL-82645) - tests: Add firmware-manual-efi-sev-snp (RHEL-82645) - tests: Add firmware-manual-efi-tdx (RHEL-82645) - qemu_firmware: ROM firmware is always in raw format (RHEL-82645) - qemu_firmware: Don't skip autoselection for ROM (RHEL-82645) - qemu_firmware: Allow matching both UEFI and BIOS for ROM loader (RHEL-82645) - schema: Add firmwareFeatures element for domaincaps (RHEL-82645) - conf: Add firmwareFeatures element for domaincaps (RHEL-82645) - qemu: Fill in firmwareFeature element for domaincaps (RHEL-82645) - docs: Document firmwareFeature element for domaincaps (RHEL-82645) - docs: Rename "BIOS bootloader" section to "guest firmware" (RHEL-82645) - docs: Improvement related to firmware selection (RHEL-82645) - qemu_firmware: Only set format for custom loader if path is present (RHEL-82645) - conf: Move type=rom default for loader to drivers (RHEL-82645) - tests: Rename custom JSON firmware descriptors (RHEL-82645) - schema: Introduce osnvram define (RHEL-82645) - conf: Parse and format varstore element (RHEL-82645) - conf: Update validation to consider varstore element (RHEL-82645) - qemu_capabilities: Introduce QEMU_CAPS_DEVICE_UEFI_VARS (RHEL-82645) - qemu: Validate presence of uefi-vars device (RHEL-82645) - tests: Add firmware-manual-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-manual-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-q35 (RHEL-82645) - tests: Add firmware-auto-efi-varstore-aarch64 (RHEL-82645) - tests: Add firmware-auto-efi-enrolled-keys-aarch64 (RHEL-82645) - qemu_firmware: Parse host-uefi-vars firmware feature (RHEL-82645) - qemu_firmware: Split sanity check (RHEL-82645) - qemu_firmware: Consider host-uefi-vars feature in sanity check (RHEL-82645) - qemu_firmware: Support extended syntax for ROM firmware descriptors (RHEL-82645) - qemu_firmware: Report NVRAM template path for ROMs (RHEL-82645) - conf: Include varstore element in domcaps (RHEL-82645) - qemu: Fill in varstore element in domcaps (RHEL-82645) - qemu_firmware: Use of NVRAM implies stateful firmware (RHEL-82645) - qemu_firmware: Allow matching stateful ROMs (RHEL-82645) - qemu_firmware: Fill in varstore information (RHEL-82645) - qemu: Introduce varstoreDir (RHEL-82645) - qemu_firmware: Generate varstore path when necessary (RHEL-82645) - qemu: Introduce qemuPrepareNVRAMFileCommon() (RHEL-82645) - qemu: Create and delete varstore file (RHEL-82645) - security: Mark ROMs as read only when using AppArmor (RHEL-82645) - security: Handle varstore file (RHEL-82645) - tests: Add firmware descriptors for uefi-vars builds (RHEL-82645) - qemu_command: Use uefi-vars device where appropriate (RHEL-82645) - include: Mention varstore where applicable (RHEL-82645) - virsh: Update for varstore handling (RHEL-82645) - domain_conf: initialize network hostdev private data (RHEL-151916) - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151916) - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150351) - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150351) - util: Move openning IOMMU device to viriommufd (RHEL-150351) - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150351) - util: Move openning VFIO device to virpci (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150351) - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150351) - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150351) - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150351) - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150351) - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150351) - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150351) - qemuxmlconftest: Refactor host device preparation (RHEL-150351) - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150351) - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150351) - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150351) - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150351) - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150351) - qemu: Save IOMMUFD state into status XML (RHEL-150351) - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150351) - qemu_command: Extract building IOMMUFD props to function (RHEL-150351) - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150351) - conf: Introduce iommufd enum for domaincaps (RHEL-148135) - qemu: Fill iommufd domain capability (RHEL-148135) - tests: properly mock VFIO and IOMMU checks (RHEL-148135) - iommufd: fix FD leak in case of error (RHEL-150351) - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-135115) - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-135115) - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-135115) - qemu: Implement support for persistent reservation migration control (RHEL-135115) - qemu: Extract disk setup done via QMP into a separate helper (RHEL-131335) - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-131335) - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-131335) - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-131335) - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-131335) - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-131335) - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-131335) - Introduce support for disk operation latency histogram collection (RHEL-131335) - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-131335) - src/esx/esx_vi.c: Debug path element comparisons (RHEL-145080) - qemu: Ignore cmp_legacy CPU flag (RHEL-148494) - src: Use device alias when ifname is unset in virDomainInterfaceAddresses() (RHEL-143933) - qemu: Implement support for associating iommufd to hostdev (RHEL-126346, RHEL-74202) - qemu: Introduce privateData for hostdevs (RHEL-126346, RHEL-74202) - qemu: Support per-process memory accounting for iommufd (RHEL-126346, RHEL-74202) - qemu: open VFIO FDs from libvirt backend (RHEL-126346, RHEL-74202) - qemu: open iommufd FD from libvirt backend (RHEL-126346, RHEL-74202) - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126346, RHEL-74202) - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126346, RHEL-74202) - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145769) - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145769) - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145769) - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145769) - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-141820) - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-141820) - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-141820) - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-141820) - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144089) - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144089) - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144089) - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144089) - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144089) - esx: Debug URL just before opening with curl (RHEL-138300) - esx: Abstract all URL-creation code into one function (RHEL-138300) - esx: Switch to creating URLs using virURIFormat (RHEL-138300) - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140196) - esx: URI encode inventory objects twice (RHEL-140196) - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - adding gating.yaml configuration - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New upstream release - Update C++ standard from C++11 to C++14 - Compilation fixes for recent versions of GCC - Small fixes to Finnish grammar checker - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Migrate license tag to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-102467, update to 2.2.11 - Resolves: RHEL-93155, multiple errors of vpcupdate during boot - Update to 2.2.10, fix displaying duplicate VPD details Resolves: RHEL-24572 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add patch for superindex full Resolves: RHEL-150332 - Bump version for rebuild Resolves: RHEL-93904 - Bump version for rebuild Resolves: RHEL-93904 - Add patch for double free Resolves: RHEL-93904 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to 1.14.1 Resolves: RHEL-40644 - Replace yasm with nasm Resolves: RHEL-45221 - Bump release for June 2024 mass rebuild - Rearrange the dial leaders for the Intuos Pro 3rd Gen (RHEL-122812) - Rearrange the button leaders for the Intuos Pro 3rd Gen (RHEL-101873) - Add Wacom Intuos Pro 3rd Gen and newest Cintiqs (RHEL-101873) - libwacom 2.14 (RHEL-70830) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libwacom 2.12.2 - libwacom 2.12.1 - libwacom 2.12 - libwacom 2.10.0 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Updated License (RHEL-105872) - Backport the move to SPDX license format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fixed rpm dependency - Disable libwebp-java on RHEL - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Backport several CVE fixes (CVE-2026-85089, CVE-2026-91946, CVE-2026-91947, CVE-2026-91950, CVE-2026-91953, CVE-2026-91954, CVE-2026-91956, CVE-2026-91959, CVE-2026-91960, CVE-2026-91963, CVE-2026-91964) Resolves: RHEL-253892, RHEL-260716, RHEL-260750, RHEL-260763, RHEL-260778 Resolves: RHEL-260794, RHEL-260807, RHEL-260842, RHEL-260856, RHEL-260891 Resolves: RHEL-260912 - Abort after PROTOCOL_FAILED_NEGO (CVE-2026-91949) Resolves: RHEL-264913 - Fix several regressions in CVE-2026-73241 Resolves: RHEL-257781 - Fix RPC gateway fragment size and capacity checks (CVE-2026-55193) Resolves: RHEL-247346 - Backport several CVE fixes (CVE-2026-55194, CVE-2026-63633, CVE-2026-63652, CVE-2026-67288, CVE-2026-67291, CVE-2026-67296, CVE-2026-67297, CVE-2026-67301, CVE-2026-67304, CVE-2026-69159, CVE-2026-73241) Resolves: RHEL-245652, RHEL-245635, RHEL-245599, RHEL-245539, RHEL-238534 Resolves: RHEL-236056, RHEL-227734, RHEL-225225, RHEL-225097, RHEL-224250 Resolves: RHEL-224185 - Backport several CVE fixes (CVE-2026-67298, CVE-2026-73242) Resolves: RHEL-224050, RHEL-238931 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-147913, RHEL-148817, RHEL-148861, RHEL-148977, RHEL-148894 - Backport several CVE fixes (CVE-2026-64620, CVE-2026-64621, CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580) Resolves: RHEL-212621, RHEL-212978, RHEL-213168, RHEL-222783, RHEL-222983, Resolves: RHEL-223604 - Add codecID checks for CACHE_BITMAP_V3_ORDER (CVE-2026-55827) - Fix boundary checks in gdi_Bitmap_Decompress (CVE-2026-55827) Resolves: RHEL-194327 - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 - Lock appWindow to fix use-after-free in RAIL mode (CVE-2026-25952) Resolves: RHEL-159848 - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986) - Fix clipboard use-after-free during auto-reconnect (CVE-2026-25997) - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775) - Add DSP format checks (CVE-2026-31884) - Fix DSP array bounds checks (CVE-2026-31883) - Fix DSP array bounds checks (CVE-2026-31885) - Update PERSISTENT_CACHE_ENTRY::size after realloc (CVE-2026-33987) - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985) - Use winpr_aligned_calloc in persistent cache (CVE-2026-33982) Resolves: RHEL-159804, RHEL-159660, RHEL-161034, RHEL-161469 Resolves: RHEL-161505, RHEL-161072, RHEL-163654, RHEL-168462, RHEL-162931 - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984) - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983) Resolves: RHEL-162947, RHEL-162963 - Rebuilt for errata Resolves: RHEL-155980 - Fix use of nsc_process_message - Increase timeout for TestSynchCritical Resolves: RHEL-155980 - Backport several CVE fixes Resolves: RHEL-147950, RHEL-147951, RHEL-147966, RHEL-147967, RHEL-147971 Resolves: RHEL-147997, RHEL-147998, RHEL-148006, RHEL-148007, RHEL-148900 Resolves: RHEL-148986, RHEL-148989, RHEL-149053, RHEL-155980 - Backport several CVE fixes Resolves: RHEL-151976, RHEL-152203 - Backport several CVE fixes Resolves: RHEL-142414, RHEL-142398, RHEL-142382, RHEL-142366, RHEL-142350 Resolves: RHEL-142334, RHEL-142318 - Try next DNS entry on connect failure Resolves: RHEL-140099 - Fix broken SSL checks and disable runtime checks (RHEL-73724) - Silence abidiff - Resolves: RHEL-86251 - Limit threadpool to 16 threads - Resolves: RHEL-86251 - Initialize function pointers after resource allocation - Fixes CVE-2025-4478 - Resolves: RHEL-91583 - Update to 3.10.3 - Update to 3.9.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 3.8.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - fix rhbz (#2242944) - disable Revert-pager-do-not-change-workspace-size-from-size patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 + libxcrypt-4.4.36-9 - Added back -compat package for RHEL 10 (final) - CI and gating for RHEL 10 - Bumped version not to clash with previous bad build. - Added back -compat package for RHEL 10 (bootstrap) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Remove -compat package from Fedora ELN / RHEL 10 - Fix C compatibility issue in the configure script - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix explicit package version requirement (RHEL-45635). - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upstream version bump - Upstream version bump - Drop upstreamed patch - Upstream version bump - Add annocheck exceptions for BPF objects (Felix) - Re-enable debug builds (Felix) - Add libcap-ng-devel to BuildDepends - Upstream version bump - Fix build with Clang 20 - Upstream version bump - Upstream version bump - Upstream version bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Upstream version bump - Upstream version bump - Drop upstreamed patch - Upstream version bump - Add annocheck exceptions for BPF objects (Felix) - Re-enable debug builds (Felix) - Add libcap-ng-devel to BuildDepends - Upstream version bump - Fix build with Clang 20 - Upstream version bump - Upstream version bump - Upstream version bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Explicitly Require libxkbcommon in x11-utils for rpminspect - libxkbcommon 1.7.0 - Split the x11-utils into their own subpackage with the right requires - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libxkbcommon 1.6.0 - SPDX migration: update to SPDX license identifiers - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libxbkcommon 1.5.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - libxkbfile 1.1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - libxkbfile 1.1.2 - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - libxkbfile 1.1.1-1 - Fix xmllint error code (RHEL-126768) - Fix CVE-2025-32415 (RHEL-100174) - Fix CVE-2025-32414 (RHEL-99861) - Fix CVE-2025-7425 (RHEL-102794) - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421) - Fix CVE-2024-56171 (RHEL-80119) - Fix CVE-2025-24928 (RHEL-80134) - Fix CVE-2024-40896 (RHEL-72060) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 2.12.5 (#2262648) - Fix CVE-2024-34459 (RHEL-177890) - Fix xmllint error code (RHEL-126768) - Fix CVE-2025-32415 (RHEL-100174) - Fix CVE-2025-32414 (RHEL-99861) - Fix CVE-2025-7425 (RHEL-102794) - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421) - Fix CVE-2024-56171 (RHEL-80119) - Fix CVE-2025-24928 (RHEL-80134) - Fix CVE-2024-40896 (RHEL-72060) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix CVE-2025-6170 (RHEL-182007) - Fix CVE-2024-34459 (RHEL-177890) - Fix xmllint error code (RHEL-126768) - Fix CVE-2025-32415 (RHEL-100174) - Fix CVE-2025-32414 (RHEL-99861) - Fix CVE-2025-7425 (RHEL-102794) - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421) - Fix CVE-2024-56171 (RHEL-80119) - Fix CVE-2025-24928 (RHEL-80134) - Fix CVE-2024-40896 (RHEL-72060) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix CVE-2026-11979 (RHEL-215571) - Fix CVE-2025-6170 (RHEL-182007) - Fix CVE-2024-34459 (RHEL-177890) - Fix xmllint error code (RHEL-126768) - Fix CVE-2025-32415 (RHEL-100174) - Fix CVE-2025-32414 (RHEL-99861) - Fix CVE-2025-7425 (RHEL-102794) - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421) - Fix CVE-2024-56171 (RHEL-80119) - Fix CVE-2025-24928 (RHEL-80134) - Fix CVE-2024-40896 (RHEL-72060) - Fix CVE-2026-86144 (RHEL-256302) - Fix CVE-2026-86140 (RHEL-256024) - Fix CVE-2026-74860 (RHEL-255957) - Fix CVE-2026-86142 (RHEL-256368) - Fix CVE-2026-86143 (RHEL-256896) - Fix CVE-2026-86138 (RHEL-256948) - Fix CVE-2026-11979 (RHEL-215571) - Fix CVE-2025-6170 (RHEL-182007) - Fix CVE-2024-34459 (RHEL-177890) - Fix xmllint error code (RHEL-126768) - Fix CVE-2025-32415 (RHEL-100174) - Fix CVE-2025-32414 (RHEL-99861) - Fix CVE-2025-7425 (RHEL-102794) - Refresh patches from upstream (RHEL-96395, RHEL-96408 and RHEL-96421) - Fix CVE-2025-6021 (RHEL-96495) - Fix CVE-2025-49794 (RHEL-96395) - Fix CVE-2025-49795 (RHEL-96408) - Fix CVE-2025-49796 (RHEL-96421) - Fix CVE-2024-56171 (RHEL-80119) - Fix CVE-2025-24928 (RHEL-80134) - New upstream release - Sync the content of main.fmf from rhel9 to rhel10 - New upstream release - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Remove build dependency on libstemmer-devel - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add MinGW packages. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Review the license tag according to the SPDX standard, declare the docs license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Properly check valgrind arches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673 - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Properly check valgrind arches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673 - Resolves: RHEL-119430 - Move libyang-devel to CRB - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - New version 2.1.148 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.10.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 1.10.0 - use python3-nihtest instead of perl for tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Silent miscompilation with GCC 14 due to C89 compatibility issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Port sgmls non-autoconf configure script to C99 - New version 0.9.82 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Include nodejs build dependency explicitely - Bump release for October 2024 mass rebuild: - Backport fix for CVE-2024-27982 - Update to 9.2.1 - Run llhttp test for gating - Bump release for June 2024 mass rebuild - Enable RHEL gating for llhttp - Avoid licensecheck dependency in RHEL builds - Better audit (and document auditing of) dev dependency licenses - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Add gating.yaml and .fmf plan for RHEL gating - Bump release for June 2024 mass rebuild - Update to version 0.9.32 (rhbz#2261350) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Expand description for lmdb-libs subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 0.9.31 (rhbz#2221768) - migrated to SPDX license - Bump release for October 2024 mass rebuild: - Add gating.yaml and .fmf plan for RHEL gating - Bump release for June 2024 mass rebuild - Update to version 0.9.32 (rhbz#2261350) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Expand description for lmdb-libs subpackage - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to version 0.9.31 (rhbz#2221768) - migrated to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory leaks found by static analysis - Resolves: RHEL-39379 - Bump release for June 2024 mass rebuild - Use an SPDX license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Version bump - Update of location of fmf plans - Bump release for October 2024 mass rebuild: - Allow inet_addr() for now - Add fmf plans and gating.yaml - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New version 2.1.1 (rhbz#2250290) - Fix incorrect upstream URL and SourceX (rhbz#2249526) - SPDX migration - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop requires on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop requires on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop requires on java-devel - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Do not install zip files - Update to upstream version 2.20.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New upstream release - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - New upstream release - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - disable "corrupted binary dump" test that has issues on big-endian architectures - apply upstream fix for 5.4.6 bug 1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to 5.4.6 - add upstream fixes for Bugs 8 and 9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add patch for http://lua-users.org/lists/lua-l/2022-02/msg00112.html (#2111138) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 1.0.2 - Initial packaging - Additional fixes up to 2.03.38. - Update to upstream version 2.03.36. - See WHATS_NEW and WHATS_NEW_DM for more information. - Update to upstream version 2.03.35. - See WHATS_NEW and WHATS_NEW_DM for more information. - Respin. - Fix vgremove hanging immediately after lockstart. - Add repair option for RAID volumes with too many transiently failed devices. - Update to upstream version 2.03.32. - See WHATS_NEW and WHATS_NEW_DM for more information. - Fix race causing lvm2 not recognizing active devices. - Add libnvme dependency to really fix the NVMe issue. - Fix temporary LVs not cleaned when converting in use LV to a thin pool. - Check FS resize is supported before extending LV. - Fix issue affecting memory locking before suspend (2.03.27). - Workaround for NVMe WWID changing after kernel update. - Fix duplicate LV names when converting pools to RAID1 with more than 2 legs. - Rebase to 3.4.4 - Disable option that requires all connections to be SSL encrypted by default - Rebase to 3.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 3.4.1 - Rebase to 3.3.10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 3.3.8 - CVE-2026-44172 fix - Rebase to 3.4.4 - Disable option that requires all connections to be SSL encrypted by default - Rebase to 3.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 3.4.1 - Rebase to 3.3.10 - Rebase to 3.4.4 - Disable option that requires all connections to be SSL encrypted by default - Rebase to 3.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 3.4.1 - Rebase to 3.3.10 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to 3.3.8 - CVE-2026-44172 fix - Rebase to 3.4.4 - Disable option that requires all connections to be SSL encrypted by default - Rebase to 3.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to 3.4.1 - Rebase to 3.3.10 - Test with Python 3.12 and 3.14 during the build - Drop STI and use tmt instead - Improve testing during RPM build - Update CI testing matrix - Update to 0.4.0 (rhbz#2321237) - Change the test source location - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add RHEL gating configuration - CI: Remove tests for Pythons not available in c10s - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.6.1 - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.6.1 - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52696 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52696 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 5.1.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-bundle - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 5.1.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rename package from maven-plugin-bundle - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.11.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 1.13.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 1.13.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add dependency on commons-lang3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.6.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Add dependency on commons-lang3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.6.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.2.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.0 - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52697 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52697 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add missing configuration file for maven-openjdk25 - Add maven-openjdk25 binding - Update to upstream version 3.9.9 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop OpenJDK 17 subpackage - Resolves: RHEL-51273 - Bump release for Aug 2024 java mass rebuild - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Update to upstream version 43 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 41 - Rebuild - Update to upstream version 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52698 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52698 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52698 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.9.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.9.18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 1.9.15 - Build with default JDK 17 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52699 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52699 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 3.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 3.2.2 - Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add missing configuration file for maven-openjdk25 - Add maven-openjdk25 binding - Update to upstream version 3.9.9 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop OpenJDK 17 subpackage - Resolves: RHEL-51273 - Bump release for Aug 2024 java mass rebuild - Rebuild - Drop openjdk8 and openjdk11 subpackages - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.0~M1 - Update to upstream version 1.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.0~M1 - Update to upstream version 1.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update Java compiler target settings - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52700 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration (ljavorsk) - Use %license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Backport upstream fix for symlinks on riscv64 - Update to 1.4.1 - gating enabled - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.3.1 - add packit automation for pull_from_upstream - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add RHEL gating configuration - CI: Run upstream testsuite - Merge plans/integration.fmf into plan.fmf - Add smoke test for tmt - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.6.0 (rhbz#rhbz#2251885) - Update to 1.5.2 - Synchronize with Fedora Rawhide Resolves: RHEL-102712 - Synchronize with Fedora Rawhide Resolves: RHEL-73815 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add pkgconfig provides - Add dependency on cmake-rpm-macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set mingw_env before in run_mingw_make - Set RUSTFLAGS in mingw env - Synchronize with Fedora Rawhide Resolves: RHEL-102712 - Synchronize with Fedora Rawhide Resolves: RHEL-73815 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73312 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add pkgconfig provides - Add dependency on cmake-rpm-macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set mingw_env before in run_mingw_make - Set RUSTFLAGS in mingw env - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73822 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102712 - Synchronize with Fedora Rawhide Resolves: RHEL-73815 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73312 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73820 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add pkgconfig provides - Add dependency on cmake-rpm-macros - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Set mingw_env before in run_mingw_make - Set RUSTFLAGS in mingw env - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73822 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-102715 - Synchronize with Fedora Rawhide Resolves: RHEL-73821 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 14.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 13.2.1 (20230728) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Synchronize with Fedora Rawhide Resolves: RHEL-73825 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 11.0.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 11.0.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Move to SPDX license format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.0.5 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Move to SPDX license format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.0.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.0.5 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to spdx license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream release 20230416 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to upstream release 20221107 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 5.8.0 - Update to upstream version 5.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.1.2 - Update to upstream version 2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.1.2 - Update to upstream version 2.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Rebuild - Initial build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Implement bootstrap mode - Rebuild - Initial build - Fix generated main-class module attributes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52701 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Implement bootstrap mode - Initial build - Fix generated main-class module attributes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52701 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Implement bootstrap mode - Initial build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 78 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 77 - Convert License tag to SPDX format - Update to upstream version 76 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library Resolves: RHEL-33509 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Split libmpdec++ into a mpdecimal++ subpackage - This prevents packages only using the libmpdec library from transitively depending on libstdc++ - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library Resolves: RHEL-33509 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Split libmpdec++ into a mpdecimal++ subpackage - This prevents packages only using the libmpdec library from transitively depending on libstdc++ - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library Resolves: RHEL-33509 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Split libmpdec++ into a mpdecimal++ subpackage - This prevents packages only using the libmpdec library from transitively depending on libstdc++ - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to 1.32.9, include patches for CVE-2024-10573 Resolves: RHEL-69787 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.31.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.31.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package unretired - Update to upstream version 2022.7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package unretired - Update to upstream version 2022.7 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration: mark license as SPDX compatible - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt to apply fix regarding switch from 'uname -i' to 'uname -m' in the last commits - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-25506 - Bump release for October 2024 mass rebuild: - Adding files for c10s gating test - Bump release for June 2024 mass rebuild - Fix flaky popup test - Fix flaky test case - Update to 49.4 - Update to 49.1.1 - Bundle newer meson - Use SPDX license - Deduce source URL from version - Fix path to gdctl when running installed test - Backport gdctl utility - Fix polyinstantiation preventing Xwayland to start - Handle unmaximize when headless - Fix flaky popup test - Fix flaky test case - Update to 49.4 - Update to 49.1.1 - Bundle newer meson - Use SPDX license - Deduce source URL from version - Fix path to gdctl when running installed test - Backport gdctl utility - Add riscv64 support - Rebase to 8.4.11 - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Rebase to 8.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for a rebuild - Add riscv64 support - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Add riscv64 support - Rebase to 8.4.11 - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Rebase to 8.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for a rebuild - Add riscv64 support - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Add riscv64 support - Rebase to 8.4.11 - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Rebase to 8.4.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for a rebuild - Add riscv64 support - Rebase to 8.4.9 - Revert to soft static allocation of MariaDB and MySQL sysusers.d files - Rebase to 8.4.8 - Skip tests that are failing on Konflux - Resolves: ROK-831 - Rebase to 8.4.7 - Rebase to 8.4.6 - Rebase to 8.4.5 - Rebuilt - Rebase to 8.4.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Spec File: Migrated to SPDX license. (#2222114) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - add Obsoletes for the dropped subpackage - update to 2.16.01 (#2155636) - drop obsolete patch - drop rdoff subpackage (discontinued upstream) - Add rpminspect.yaml to ignore problematic desktop test - Update to 47.6 - Update to 47.1 - Exclude flatpak-specific files - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 46.2 - Update to 46.1 - Update to 46.0 - Update to 46.rc - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Rebuild for OCaml 5.2 - cow: Support overlays larger than 16T on ext4 + further fixes resolves: RHEL-164229 - Rebase to nbdkit 1.46.2 - Backport nbdkit_debug_hexdiff, nbdkit_name, nbdkit_timestamp from nbdkit 1.47. resolves: RHEL-111242 - Synchronize spec file with Fedora. - vddk: Don't use FNM_PATHNAME when matching export parameter resolves: RHEL-122755 - Fix assertion failure in blocksize-policy filter - Fix v2v conversion failure when minimum_io_size > 64K resolves: RHEL-139390 - Test and document that VDDK 9.0.1.0 works resolves: RHEL-140615 - Rebase to nbdkit 1.44.1 resolves: RHEL-78830, RHEL-101180 - Synch the spec file with Fedora Rawhide. - nbdkit-ondemand-plugin moves into a new subpackage. - New nbdkit-count-filter & nbdkit-time-limit-filter. - Remove nbdkit-cacheextents-filter. - Add extra system call checking and debugging to nbdkit-file-plugin resolves: RHEL-85515 - Allow nbdkit-file-plugin to zero and trim block devices resolves: RHEL-89371 - vddk: Pre-cache the extents for readonly connections resolves: RHEL-94825 - Log filename, offset and count in nbdkit-file-plugin error messages resolves: RHEL-95364 - vddk: Improve statistics related: RHEL-94825 - CVE-2025-47711 denial of service attack by client sending maximum size block status - CVE-2025-47712 denial of service attack by client sending large unaligned size block status resolves: RHEL-95819 - Add support for VDDK 9.0.0.0 resolves: RHEL-99467 - server: Fix .zero fallback path resolves: RHEL-101636 - vddk: Avoid reading partial chunk beyond the end of the disk resolves: RHEL-71697 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to nbdkit 1.40.4 - Rebase to nbdkit 1.40.0 related: RHEL-49594 - Send the last error to the NBD client resolves: RHEL-50666 - Re-add libxcrypt dependency resolves: RHEL-47272 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - New upstream release 11.09.00 - Review and update license field (RHEL-64359) - build netpbm with correct LDFLAGS (RHEL-70899) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - GCC 14 compatibility fixes: Drop netpbm-cmuwtopbm.patch to fix an out-of-bounds stack write (#2259450) Stub out unused converter/other/jpeg2000/libjasper_compat.c (#2259448) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for jasper 4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - New upstream release 11.09.00 - Review and update license field (RHEL-64359) - build netpbm with correct LDFLAGS (RHEL-70899) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - GCC 14 compatibility fixes: Drop netpbm-cmuwtopbm.patch to fix an out-of-bounds stack write (#2259450) Stub out unused converter/other/jpeg2000/libjasper_compat.c (#2259448) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for jasper 4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update expected test suite results (Phil Sutter) [RHEL-121194] - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194] - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861] - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861] - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861] - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861] - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861] - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194] - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194] - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194] - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194] - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194] - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194] - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194] - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194] - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194] - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194] - doc: fix tcpdump example (Phil Sutter) [RHEL-121194] - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194] - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194] - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194] - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194] - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194] - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194] - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194] - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194] - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-113851] - Bump revision for a side-tag build (Phil Sutter) [RHEL-125122] - spec: BuildRequire libnftnl-devel-1.2.8-4 (Phil Sutter) [RHEL-125122] - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851] - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851] - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743] - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205] - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994] - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994] - evaluate: allow to re-use existing metered set [RHEL-75507] - Fix for typo in gating.yaml (Phil Sutter) [RHEL-65346] - Bump revision to overcome pipeline issues (Phil Sutter) [RHEL-128553] - spec: Require libnftnl-1.3.0-3 for nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553] - tests: py: Adjust payloads to changed userdata printing (Phil Sutter) [RHEL-128553] - tests: py: Update payload records (Phil Sutter) [RHEL-128553] - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-128553] - tests: py: tools: Add regen_payloads.sh (Phil Sutter) [RHEL-128553] - netlink: Make use of nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553] - netlink: No need to reference array when passing as pointer (Phil Sutter) [RHEL-128553] - netlink: Introduce struct nft_data_linearize::sizes (Phil Sutter) [RHEL-128553] - netlink: Introduce struct nft_data_linearize::byteorder (Phil Sutter) [RHEL-128553] - expression: Set range expression 'len' field (Phil Sutter) [RHEL-128553] - intervals: Convert byte order implicitly (Phil Sutter) [RHEL-128553] - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-128553] - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-128553] - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-128553] - Update expected test suite results (Phil Sutter) [RHEL-121194] - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194] - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861] - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861] - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861] - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861] - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861] - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194] - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194] - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194] - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194] - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194] - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194] - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194] - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194] - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194] - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194] - doc: fix tcpdump example (Phil Sutter) [RHEL-121194] - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194] - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194] - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194] - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194] - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194] - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194] - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194] - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194] - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-113851] - Bump revision for a side-tag build (Phil Sutter) [RHEL-125122] - spec: BuildRequire libnftnl-devel-1.2.8-4 (Phil Sutter) [RHEL-125122] - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851] - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851] - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743] - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205] - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994] - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994] - tests: Prepare exit codes for automake (Phil Sutter) [RHEL-179035] - parser_json: fix map/set type confusion crash in map statement parser (Phil Sutter) [RHEL-179035] - intervals: Fix for inconsistent union field use (Phil Sutter) [RHEL-179035] - Bump revision to overcome pipeline issues (Phil Sutter) [RHEL-128553] - spec: Require libnftnl-1.3.0-3 for nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553] - tests: py: Adjust payloads to changed userdata printing (Phil Sutter) [RHEL-128553] - tests: py: Update payload records (Phil Sutter) [RHEL-128553] - tests: py: objects.t: must use input, not output (Phil Sutter) [RHEL-128553] - tests: py: tools: Add regen_payloads.sh (Phil Sutter) [RHEL-128553] - netlink: Make use of nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-128553] - netlink: No need to reference array when passing as pointer (Phil Sutter) [RHEL-128553] - netlink: Introduce struct nft_data_linearize::sizes (Phil Sutter) [RHEL-128553] - netlink: Introduce struct nft_data_linearize::byteorder (Phil Sutter) [RHEL-128553] - expression: Set range expression 'len' field (Phil Sutter) [RHEL-128553] - intervals: Convert byte order implicitly (Phil Sutter) [RHEL-128553] - mergesort: Align concatenation sort order with Big Endian (Phil Sutter) [RHEL-128553] - mergesort: Fix sorting of string values (Phil Sutter) [RHEL-128553] - segtree: Fix range aggregation on Big Endian (Phil Sutter) [RHEL-128553] - Update expected test suite results (Phil Sutter) [RHEL-121194] - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194] - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861] - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861] - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861] - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861] - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861] - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194] - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194] - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194] - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194] - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194] - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194] - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194] - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194] - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194] - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194] - doc: fix tcpdump example (Phil Sutter) [RHEL-121194] - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194] - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194] - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194] - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194] - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194] - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194] - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194] - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194] - fib: Fix for existence check on Big Endian (Phil Sutter) [RHEL-113851] - Bump revision for a side-tag build (Phil Sutter) [RHEL-125122] - spec: BuildRequire libnftnl-devel-1.2.8-4 (Phil Sutter) [RHEL-125122] - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851] - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851] - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743] - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205] - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) - Spec bump (RHEL-103655) - PQC: make X25519MLKEM768 the default TLS key exchange group in nghttpd and nghttpx (RHEL-103655) - update to the latest upstream release (RHEL-143723) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - update to the latest upstream release - update to the latest upstream release - update to the latest upstream release - Bump release for June 2024 mass rebuild - update to the latest upstream release - fixes CVE-2024-28182 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055) - fix Denial of service: Assertion failure due to the missing state validation (CVE-2026-27135) - Spec bump (RHEL-103655) - PQC: make X25519MLKEM768 the default TLS key exchange group in nghttpd and nghttpx (RHEL-103655) - update to the latest upstream release (RHEL-143723) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - update to the latest upstream release - update to the latest upstream release - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) - rebuild for the right candidate tag - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections - Clarify binding behavior of -t option. - Remove 50x.html from the nginx package - Run tests in centos-stream namespace - Add tmpfiles.d rules for /var directories (bootc compatibility) - New version 1.26.3 - Use systemd-sysusers - Resolves: RHEL-178669 - nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) - rebuild for the right candidate tag - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections - Clarify binding behavior of -t option. - Remove 50x.html from the nginx package - Run tests in centos-stream namespace - Add tmpfiles.d rules for /var directories (bootc compatibility) - New version 1.26.3 - Resolves: RHEL-191778 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) - Resolves: RHEL-178669 - nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) - rebuild for the right candidate tag - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections - Clarify binding behavior of -t option. - Remove 50x.html from the nginx package - Run tests in centos-stream namespace - Add tmpfiles.d rules for /var directories (bootc compatibility) - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) - Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) - Resolves: RHEL-191778 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) - Resolves: RHEL-178669 - nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) - rebuild for the right candidate tag - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections - Clarify binding behavior of -t option. - Remove 50x.html from the nginx package - Run tests in centos-stream namespace - Resolves: RHEL-212454 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests (CVE-2026-42533) - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) - Resolves: RHEL-217956 - nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) - Resolves: RHEL-191778 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution or. Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055) - Resolves: RHEL-178669 - nginx: code execution and denial of service (CVE-2026-9256) - Resolves: RHEL-182544 - nginx: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack - Resolves: RHEL-176231 - nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945) - rebuild for the right candidate tag - RHEL-159547 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module - RHEL-159526 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file - RHEL-159434 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled - RHEL-157875 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections - Clarify binding behavior of -t option. - Remove 50x.html from the nginx package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Handle Python 3.13 removal of `pipes`, resolves rhbz#2245655 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Upgrade to 2.2.49 - Ignore desired MAC for bonds with fail_over_mac. RHEL-106135 - Fix setting DNS only with search or option. RHEL-102333 - Upgrade to 2.2.48 - Validate OVN bridge mapping. RHEL-37922 - Support bond `lacp_active` and `ns_ip6_target`. RHEL-1415 - Support matching by PCI adress. RHEL-80116 - Apply dispatch changes first. RHEL-94840 - Fix SRIOV VF reference. RHEL-91588 - Fix deleting with `fail_over_mac` bond. RHEL-102600 - Upgrade to 2.2.46 - Store DNS to both iface and global DNS. RHEL-91250 - Support nmpolicy against down iface. RHEL-86240 - Support removal VLAN connection with empty ifname. RHEL-92916 - Upgrade to 2.2.45 - Fix stuck on `nmstatectl show`. RHEL-93154 - Fix infiniband devices - Upgrade to 2.2.60 - ipv4: Add new parameter prefix-route-metric RHEL-170697 - Upgrade to 2.2.59 - Add support for lock-mtu option. RHEL-151937 - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Upgrade to 2.2.49 - Ignore desired MAC for bonds with fail_over_mac. RHEL-106135 - Fix setting DNS only with search or option. RHEL-102333 - Ignore IP addresses with non-kernel IFA_PROTO RHEL-253627 - Fix infiniband devices - Upgrade to 2.2.60 - ipv4: Add new parameter prefix-route-metric RHEL-170697 - Upgrade to 2.2.59 - Add support for lock-mtu option. RHEL-151937 - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Upgrade to 2.2.49 - Ignore desired MAC for bonds with fail_over_mac. RHEL-106135 - Fix setting DNS only with search or option. RHEL-102333 - Upgrade to 2.2.48 - Validate OVN bridge mapping. RHEL-37922 - Support bond `lacp_active` and `ns_ip6_target`. RHEL-1415 - Support matching by PCI adress. RHEL-80116 - Apply dispatch changes first. RHEL-94840 - Fix SRIOV VF reference. RHEL-91588 - Fix deleting with `fail_over_mac` bond. RHEL-102600 - Upgrade to 2.2.46 - Store DNS to both iface and global DNS. RHEL-91250 - Support nmpolicy against down iface. RHEL-86240 - Support removal VLAN connection with empty ifname. RHEL-92916 - Upgrade to 2.2.45 - Fix stuck on `nmstatectl show`. RHEL-93154 - Fix infiniband devices - Upgrade to 2.2.60 - ipv4: Add new parameter prefix-route-metric RHEL-170697 - Upgrade to 2.2.59 - Add support for lock-mtu option. RHEL-151937 - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Upgrade to 2.2.49 - Ignore desired MAC for bonds with fail_over_mac. RHEL-106135 - Fix setting DNS only with search or option. RHEL-102333 - Ignore IP addresses with non-kernel IFA_PROTO RHEL-253627 - Fix infiniband devices - Upgrade to 2.2.60 - ipv4: Add new parameter prefix-route-metric RHEL-170697 - Upgrade to 2.2.59 - Add support for lock-mtu option. RHEL-151937 - Upgrade to 2.2.58 - vrf: Handle ignore interface when verifying desired state. RHEL-1417 - alt-name: Remove alt-names when interface marked as absent. RHEL-126481 - hsr: Automatically disable IP on hsr port. RHEL-100774 - hsr: add support for configuring "interlink" property. RHEL-100766 - Support referring alternative-name as port/parent/next-hop-interface. RHEL-126508 - Support referring interface name using its alternative name. RHEL-126510 - Upgrade to 2.2.57 - Add libreswan leftprotoport and rightprotoport support. (RHEL-107158) - Support setting protocol version of HSR/PRP. (RHEL-100763) - Fix inconsistent interface order. (RHEL-130157) - Upgrade to 2.2.56 - Allow using VRF name to specify route table. RHEL-119046 - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-53956 - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-125548 - Align with libreswan default values. RHEL-26350 - Support rightca ipsec option. RHEL-114237 - Fix error when changing existing HSR interface. RHEL-100773 - Upgrade to 2.2.54 - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121418 - Upgrade to 2.2.52 - Upgrade to 2.2.50 - Support MAC referring for VLAN in gen_conf. - Introduce state: ignore for route. - Support PCI address matching in gen_conf. - Support MacSec interface in gen_conf. - Bump release for October 2024 mass rebuild: - RHEL-10 CI setup - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - fix multilib devel conflict (rhbz#2031783) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - SPDX migration - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Fix race condition in io/tst-stat (RHEL-151711) - Remove default value for LD_PROFILE_OUTPUT (RHEL-142193) - Update locales for Croatia to use EUR as currency symbol (RHEL-140103) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428) - Remove unneeded ld-linux .debug files (RHEL-136312) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Fix NULL pointer dereference in __nss_database_get and __nss_configure_lookup (RHEL-150270) - patch-git: Avoid trailing tabs in changelog (RHEL-140226) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-5425: Fix out-of-bounds write via TSIG record processing (RHEL-180652, RHEL-185612) - CVE-2026-5928: Fix ungetwc operating on byte stream (RHEL-180654) - x86-64: Prefer EVEX512 string and memory functions on AMD Zen5 (RHEL-174869) - CVE-2026-5450: Fix buffer overflow in scanf (RHEL-172694) - Add LD_DEBUG=tls for tracking thread-local storage and TCB management (RHEL-159427) - CVE-2026-4046: Fix assertion failure in IBM1390 and IBM1399 iconv modules (RHEL-162885) - Fix __nss_get_default_domain logic to restore netgroup user enumeration (RHEL-149709) - Avoid duplicate DNS queries when search path contains "." (RHEL-142675) - Sync with upstream branch release/2.39/master (RHEL-151554) - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa - resolv: Check hostname for validity (CVE-2026-4438) - resolv: Count records correctly (CVE-2026-4437) - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Fix gconv module reference counter overflow in swscanf and swprintf families (RHEL-180800) - Fix changelog entries (RHEL-33536, RHEL-167871) - Port resolver tests to native resolv framework (RHEL-33536) - Overwrite target for x86_64_v2 - Update patch-git.lua to handle AlmaLinux branches correctly - Add support for AlmaLinux import UBI format - CVE-2026-8674: Denial of Service via long DNS search domain (RHEL-264714) - CVE-2026-77117: Non-progress DoS in SHIFT_JISX0213 decoding (RHEL-248057) - CVE-2026-80489: Non-progress DoS in EUC_JISX0213 decoding (RHEL-249634) - CVE-2026-18374: Heap buffer overflow via attacker-controlled fopen mode string (RHEL-251518) - CVE-2026-19499: Buffer overflow in strfmon right-justification padding (RHEL-248034) - CVE-2026-19542: Fix out-of-bounds array write in tdelete (RHEL-247957) - patch-git: Avoid Lua string/number arithmetic in release bump (RHEL-253648) - Fail the build if there are unexpected test failures (RHEL-252942) - CVE-2026-6791: Stack overflow in wordexp tilde expansion (RHEL-238485) - CVE-2026-6368: wordexp WRDE_APPEND state rollback on error (RHEL-238479) - Minor documentation improvements (RHEL-158699) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 9.6 - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to upstream version 9.5 - Update to upstream version 9.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - New upstream version 0.7 - New download URL - Check GPG signature resolves: RHEL-90257 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - No change, just bump release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - New upstream version 0.7 - New download URL - Check GPG signature resolves: RHEL-90257 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - No change, just bump release. - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Dropped ucs-miscfixed-fonts requirement, xorg-x11-fonts-misc is enough Resolves: RHEL-46310 - Bump release for June 2024 mass rebuild - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added SPDX licenses found by ScanCode - Dropped redundant license tags from subpackages - Migrate group creation to sysusers - Bump release and rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Revert back to ocaml-calendar 2.04 for RHEL 10 - Rebuild OCaml packages for F38 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Revert back to ocaml-calendar 2.04 for RHEL 10 - Rebuild OCaml packages for F38 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Version 3.16.0 - OCaml 5.2.0 for Fedora 41 - Version 3.15.3 - Use bundled ocaml-csexp and ocaml-pp (RHEL only) - Version 3.15.2 - Version 3.15.1 - Disable docs in RHEL builds - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Bump and rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Bump and rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Add patch to fix tests with OCaml 5.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Add patch to fix tests with OCaml 5.2.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56804 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Perl 5.40 rebuild - Rebuilt for Python 3.13 - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56804 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Perl 5.40 rebuild - Rebuilt for Python 3.13 - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Depend on ocaml-rpm-macros instead of python3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Depend on ocaml-rpm-macros instead of python3 - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Enable building for ppc64le - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Update to libguestfs-1.58.1-6 - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun) - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys) - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml - Update common submodule - Apply patches with %autosetup -S git (a patch now adds binary test data) - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - Enable building for ppc64le - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Enable building for ppc64le - Add setfiles optional excludes parameter to libguestfs resolves: RHEL-239808 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Enable building for ppc64le - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Update to libguestfs-1.58.1-6 - daemon/listfs.ml: ignore CHS geometry error from parted (Veritas/Sun) - daemon: allow base64:/text: prefixes on Key parameters (binary LUKS keys) - daemon: move read_whole_file to common/utils and rewrite luks_* APIs in OCaml - Update common submodule - Apply patches with %autosetup -S git (a patch now adds binary test data) - Enable building for ppc64le - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Rebase to libguestfs 1.52.2 (along the stable branch) - Remove dependency on syslinux packages resolves: RHEL-50565 - Fix parsing in part_get_gpt_attributes resolves: RHEL-45465 - Bump release for June 2024 mass rebuild - Enable building for ppc64le - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Bump release for Aug 2024 java mass rebuild - Enable building for ppc64le - Add setfiles optional excludes parameter to libguestfs resolves: RHEL-239808 - Ignore RHEL 7 AGFL inconsistency in xfs_repair resolves: RHEL-192920 - Use bind mount to overwrite /etc/resolv.conf resolves: RHEL-192946 - Fix binary LUKS keys resolves: RHEL-174519 - Use git to apply patches, since there is an unsupported binary patch - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Rebase to libguestfs 1.58.1 resolves: RHEL-111240 - Synchronize spec file with Fedora - Add new libguestfs ntfs_chmod API resolves: RHEL-113833 - Use setfiles -A option if available to reduce memory usage resolves: RHEL-114292 - Add -cpu max when testing for KVM via QMP resolves: RHEL-121076 - Require passt resolves: RHEL-122315 - Add AV and GPOs to inspection info resolves: RHEL-125846 - Add new xfs_info2 API resolves: RHEL-143673 - Rebase to libguestfs 1.56.1 resolves: RHEL-81733 - Include host kernel information in libguestfs debugging output resolves: RHEL-83026 - Fix virt-v2v conversion of split /usr Ubuntu 22+ resolves: RHEL-87622 - Remove dependencies on oUnit, flex, bison, file-devel - Remove zfs-fuse (not used in RHEL) - Fix gating test - Fix inspection with duplicated root mountpoint resolves: RHEL-90170 - Add btrfs-scrub-full API resolves: RHEL-91936 - Add e2fsck forceno flag resolves: RHEL-92599 - Capture and raise qemu-img stderr resolves: RHEL-92239 - Ignore btrfs snapshots of roots resolves: RHEL-93109 - Add /etc/fstab, lsblk and blkid to verbose output resolves: RHEL-106490 - Fix conversion of SLES15 with encrypted btrfs filesystem resolves: RHEL-93584 - Add guestfs_setfiles API resolves: RHEL-108832 - Ignore blank disks in Windows drive mapping resolves: RHEL-109258 - Rebase to libguestfs 1.54.0 resolves: RHEL-56810 - Fix osinfo for Windows Server 2025 resolves: RHEL-62989 - Replace Jansson with json-c resolves: RHEL-65293 - Remove squashfs-tools on RHEL resolves: RHEL-68937 - Fix perl-Sys-Guestfs debuginfo resolves: RHEL-68973 - Synchronize patches with RHEL 9.5 resolves: RHEL-56325 - appliance/init: Don't set impossible "noop" disk scheduler resolves: RHEL-56157 - Rebase to libnbd 1.24.1 resolves: RHEL-111243 - Synch spec file with Fedora - Fix unsanitized hostnames in nbd+ssh URIs allow remote execution resolves: RHEL-129296 - Implement Post-Quantum Cryptography (PQC) resolves: RHEL-101267 - Rebase to libnbd 1.24.1 resolves: RHEL-111243 - Synch spec file with Fedora - Fix unsanitized hostnames in nbd+ssh URIs allow remote execution resolves: RHEL-129296 - Implement Post-Quantum Cryptography (PQC) resolves: RHEL-101267 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream version 0.14.3 (RHBZ#1992935) - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream version 0.14.3 (RHBZ#1992935) - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - OCaml 5.1 rebuild for Fedora 40 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add fix for ppc64le code generation issue found after 5.2.0 was released - New upstream version 5.2.0 (RHBZ#2269805) - Drop upstreamed frame pointer and s390x patches - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add s390x code generation fix https://github.com/ocaml/ocaml/issues/12829 - New upstream version 5.1.1 (RHBZ#2239227) - Drop unused BR parallel - Use BR ocaml-srpm-macros to force latest to be built against - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 2.3.2 (Fixes RHBZ#2212035) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory leaks, initialize memory Resolves: RHEL-42560 - Enable LTO - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.9.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to the latest git - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Re-include openblas.pc - Resolves: RHEL-72679 - Update to 0.3.29 - Resolves: RHEL-82829 - Add riscv64 - Waive annocheck: --skip-optimization - Resolves: RHEL-33513 - Update to 0.3.28 Resolves: BZ#2273704 Resolves: RHEL-54180 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Waive annocheck: --skip-fortify and --skip-lto - Resolves: RHEL-33513 - Bump release for June 2024 mass rebuild - Fix FTBFS on ppc64le and s390x Resolves: BZ#2261415 Resolves: RHEL-24745 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Resolves: RHEL-144816, CVE-2026-23893 - Resolves: RHEL-75138, ep11 token BLS support - Resolves: RHEL-85380, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85383, cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100058, openCryptoki 3.26.0 - Resolves: RHEL-109017, pkcsslotd fails to start in FIPS mode - Resolves: RHEL-105910, require openssl >= 3.5.1 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104598 - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3 - Resolves: RHEL-90589, CCA token: basic support of AES-GCM - Resolves: RHEL-72964, cca token support cipher keys - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-73343, Upgrade openCryptoki to latest version - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75761, ep11 token: import and export of secure key objects - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys - Related: RHEL-77146, opencryptoki doesn't work in image mode - Resolves: RHEL-80632, tokens are deleted on reboot - Related: RHEL-77146, opencryptoki doesn't work in image mode - Use tmpfiles to change file ownership for image mode Related: RHEL-77146 - Resolves: RHEL-171556, Fix possible out-of-bounds access in BER decode functions - Resolves: RHEL-169565, Fix syslog message printing about different CPs - Resolves: RHEL-144816, CVE-2026-23893 - Resolves: RHEL-75138, ep11 token BLS support - Resolves: RHEL-85380, ep11 token: ML-KEM and ML-DSA support - Resolves: RHEL-85383, cca token: ML-KEM and ML-DSA support - Resolves: RHEL-100058, openCryptoki 3.26.0 - Resolves: RHEL-109017, pkcsslotd fails to start in FIPS mode - Resolves: RHEL-105910, require openssl >= 3.5.1 - Fix incorrect effective group id of pkcsslotd daemon - Fix covscan findings Resolves: RHEL-104598 - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3 - Resolves: RHEL-90589, CCA token: basic support of AES-GCM - Resolves: RHEL-72964, cca token support cipher keys - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens - Resolves: RHEL-73343, Upgrade openCryptoki to latest version - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server - Resolves: RHEL-75761, ep11 token: import and export of secure key objects - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys - Related: RHEL-77146, opencryptoki doesn't work in image mode - fix CVE-2026-27622 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - fix CVE-2026-34588 - fix CVE-2026-27622 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - Bump release for June 2024 mass rebuild - fix CVE-2026-41142 - fix CVE-2026-42216 - fix CVE-2026-34588 - fix CVE-2026-27622 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating.yaml file - fix CVE-2026-68515 - fix CVE-2026-41142 - fix CVE-2026-42216 - fix CVE-2026-34588 - fix CVE-2026-27622 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - fix CVE-2026-59982 - fix CVE-2026-59184 - fix CVE-2026-59189 - fix CVE-2026-59981 - fix CVE-2026-34544 - fix CVE-2026-68515 - fix CVE-2026-41142 - fix CVE-2026-42216 - fix CVE-2026-34588 - fix CVE-2026-27622 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Sync the RHEL version and Fedora version of the specfile - Update sources file and config.{sub|guess} - Skip verification for .soc file as it will change after install - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix installation on OSTree by removing %ghost (rhbz#2193429) - Remove %ldconfig_postun as it has no effect in Fedora - Use %{buildroot} instead of $RPM_BUILD_ROOT as it is more recent - Use directory macros and push/popd - Use %autosetup instead of deprecated %patchN - Update config.sub and config.guess files - fix CVE-2025-54874: OOB heap memory write (RHEL-107568) - fix two heap buffer overflows CVE-2024-56826 and CVE-2024-52827 (RHEL-72518,RHEL-72520) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild - updated to 2.5.2 (#RHEL-48781) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - BR: liblerc-devel - fix CVE-2025-54874: OOB heap memory write (RHEL-107568) - fix two heap buffer overflows CVE-2024-56826 and CVE-2024-52827 (RHEL-72518,RHEL-72520) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild - updated to 2.5.2 (#RHEL-48781) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - BR: liblerc-devel - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix gating failure Resolves: RHEL-70724 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Build with module-info - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modify RPM verification of ssleay.cnf Related: RHEL-113443 - Fix bogus 'sscg' arguments Related: RHEL-113443 - Update to openwsman-2.8.1 Resolves: RHEL-99191 - Update OpenSSL certificates set up Resolves: RHEL-113443 - Support added for post-quantum cryptography Resolves: RHEL-93091 - Remove deprecated path from systemd service file Resolves: RHEL-101169 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update license tags in subpackages to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52702 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 8.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52702 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 8.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Release 2025.7 - Release v2025.6 - Remove unused patches - Cherry pick https://github.com/ostreedev/ostree/pull/3516 - Release v2025.5 - Backport https://github.com/ostreedev/ostree/pull/3493 - Backport https://github.com/ostreedev/ostree/pull/3487 - Release 2025.4 - Release 2025.3 - Release 2025.2 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix description of python3-libpamtest - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Update to 2.50.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Add gating.yaml via API - Bump release for June 2024 mass rebuild - Update to 2.50.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Show radio button for single cert - Implement AccessibleText for PpsViewPage - Rebase Papers to 48.7 - Fix signing when too small rectangle is selected - Fix crash on repeated signing - Launch target file instead of openning the same file again - Fix showing of help - Fix fast navigation - Check value of "sidebar-page" key - Update Papers to current git snapshot - Rebase to papi-7.2.0. - Resolves: RHEL-121674 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Ensure sde library built with proper flags. (RHEL-33515) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebase to official papi-7.1.0. - Fix i686 rawhide FTBFS. (rhbz#2254963) - Backport upstream patch, add new patch for autoconf C compatibility - tests: Add test for dvh with a bad checksum (bcl) Related: RHEL-73220 - libparted: Fix dvh disklabel unhandled exception (bcl) Related: RHEL-73220 - tests: Add test for SUN disklabel handling (bcl) Related: RHEL-73220 - libparted: Fix sun disklabel unhandled exception (bcl) Resolves: RHEL-73220 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Upstream 3.6 stable release - Dropping pre-3.5 changelog entries - Upstream 3.5.28 Alpha release - Dropped all patches included in new upstream release - Bumped minor version on libparted.so and libparted-fs-resize.so - parted: Fix ending sector location when using kibi IEC suffix (bcl) - tests: Fix formatting and snprintf warnings in tests. (bcl) - ui: Add checks for prompt being NULL (bcl) - strlist: Handle realloc error in wchar_to_str (bcl) - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl) - filesys: Check for null from close_fn (bcl) - libparted: Fix problem with creating 1s partitions - tests: Fixing libparted test framework usage - Update selinux polices for rocestat and nvidia pmdas (RHEL-132402, RHEL-134388, RHEL-133519) - Fix pcp2openmetrics archive metric querying (RHEL-114006) - Update to latest stable version of PCP (RHEL-124897) - Make pcp-zeroconf start enabled services once again (RHEL-93182) - Fix python PMDA wrapper handling of list objects - Improve tmpfiles.d handling of empty directories - Backport some more fixes to the OpenMetrics PMDA - Fix a multilib regression in PCP header files - Backport metric removal for pmdaopenmetrics - Backport the webapi filtering fix to allow the use of exact matching. (RHEL-88201) - Add selinux policy for new proc_psi_t-induced failure - Update to latest stable version of PCP (RHEL-83468) - Fix writing of v3 archive timestamps on s390x (RHEL-69722) - Rebuild with selinux-policy-40.13.23-1 - Fix CVE-2026-16530: __pmLogLoadInDom OOB pointer dereference (RHEL-213746) - Fix CVE-2026-16531: pmproxy logger servlet path traversal (RHEL-213756) - Backport remaining PCP security hardening fixes from private-pcp - pmieconf and pmlogmv command injection hardening (CWE-78) - libpcp PDU decode OOB read and overflow guards (CWE-125/190/195) - timezone and zoneinfo string validation - pmdaroot peer credential verification (CWE-403) - pmproxy REST CERT_REQD enforcement and logger servlet authentication - Fix CVE-2026-16524: linux_sockets PMDA command injection (RHEL-213659) - Fix CVE-2026-16526: FD_CLOEXEC privilege escalation via pmdaroot (RHEL-213695) - Fix CVE-2026-16527: pmproxy unauthenticated /store access (RHEL-213721) - Fix CVE-2026-16529: __pmGetPDU signed integer overflow DoS (RHEL-213732) - Update selinux polices for rocestat and nvidia pmdas (RHEL-132402, RHEL-134388, RHEL-133519) - Fix pcp2openmetrics archive metric querying (RHEL-114006) - Update to latest stable version of PCP (RHEL-124897) - Make pcp-zeroconf start enabled services once again (RHEL-93182) - Fix python PMDA wrapper handling of list objects - Improve tmpfiles.d handling of empty directories - Backport some more fixes to the OpenMetrics PMDA - Fix a multilib regression in PCP header files - Backport metric removal for pmdaopenmetrics - Backport the webapi filtering fix to allow the use of exact matching. (RHEL-88201) - Add selinux policy for new proc_psi_t-induced failure - Update to latest stable version of PCP (RHEL-83468) - Fix and bump release, resolve the issue of build not attaching to errata - Backport CVE fixes for CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161, CVE-2026-103111 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Another rebuild for gating - Rebuild for fixed gating and fmf tests - Rebase to version 10.44 - Bump release for June 2024 mass rebuild - Explicitly require uft subpackages in tools subpackage - Rebuilt for missing gating.yaml - Migrate licenses to SPDX format and add the forgotten - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix and bump release, resolve the issue of build not attaching to errata - Backport CVE fixes for CVE-2026-86145, CVE-2026-89156, CVE-2026-89157, CVE-2026-89158, CVE-2026-89160, CVE-2026-89161, CVE-2026-103111 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Another rebuild for gating - Rebuild for fixed gating and fmf tests - Rebase to version 10.44 - Bump release for June 2024 mass rebuild - Explicitly require uft subpackages in tools subpackage - Rebuilt for missing gating.yaml - Migrate licenses to SPDX format and add the forgotten - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Use macro for buildroot - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 2.15 (rhbz#2175585) - Localize $SIG{__DIE__} before calling eval (CPAN RT#146848) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.14 (rhbz#2161420) - Remove Test::Fatal and Test::Needs from test prereqs (GH#7, GH#8) - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Modernize spec - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Update to 1.227 - New maintainer, GTERMARS - Add basic GitHub Actions setup for testing - Typo corrections in POD - Eliminated use of state/node files in temp directory - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Move redhat-rpm-config from tests to main package - Requires: redhat-rpm-config for tests - Package tests - Add test BR gcc to not skip the tests - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Use SPDX-format license tag - Use author-independent source URL - Drop redundant buildroot cleaning in %install section - Drop support for old Perl versions needing XS helper - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Upstream update. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Modernize spec. - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.34 bump (rhbz#2252645) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Convert license to SPDX. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.16 bump - Fix minimal version of IO::Socket::IP - Fix requires/provided modules in *tests package - 6.15 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2026-8450: send_file() shell-magic via 2-arg open() - Resolves: RHEL-184826 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.20 (rhbz#2256127) - Remove --no-undefined from compiler test, which is not compatible with all platforms (GH#37) - Skip t/pty_get_winsize.t tests on AIX (GH#32) - Fix patchlevel check for util.h (GH#27) - Update to 1.18 (rhbz#2251844) - Address Freebsd build issue: make function checks more robust within shared lib (GH#35) - Backport upstream patch to fix C99 compatibility issue - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 20231003.0 (rhbz#2241845) - On Windows, avoid hang under IPCRUNDEBUG (GH#157) - Refresh "cpanfile" from Makefile.PL, to allow use on Windows - Normalize shebangs to /usr/bin/perl (GH#163) - Fix or skip all tests recently seen to fail on Windows - Include t/result.t in releases - Make full_result() and result() Windows behavior match non-Windows (GH#168) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Update to 0.049. - Do not apply 0001-test-and-fix-for-RT-52317-Calling-run3-garbles-STDIN.patch - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Convert License to SPDX. - Modernize spec. - Update sources sha512. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 4.04 - Resolves: RHEL-113624 - Fix CVE-2025-40928 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - BR: glibc-langpack-en (RHBZ#2259131). - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.21 bump - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Simplify build and install phase - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix provided packages in *-tests package - Package tests - Simplify build and install phases - Update license to SPDX format - Resolves: RHEL-68426 - 1.37 bump; Fix CVE-2024-10224 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.35 bump (rhbz#2248014) - Add test BR perl(AutoLoader) (rhbz#2242265) - 1.34 bump (rhbz#2240459) - 1.33 bump (rhbz#2229212) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Package tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.144 - Fixed tilde expansion tests where ~root expands to '/' - Update to 0.142 Deprecations - Tilde expansion is deprecated due to inconsistent and bug-prone behavior Bug fixes - Prevent expansion of tildes that are not the very first character (e.g. "./~foo") - Prevent unintentional tilde expansion during internal path processing - Escape non-tilde glob characters before tilde expansion - Fixed spew/edit to a long filename approaching the filesystem length limit - Internal calls to 'print' are checked for possible errors - Internal read calls are checked for errors Changes - Path stringification now adds "./" in front of paths starting with literal tilde so they will round-trip; FREEZE updated to use this stringification rule as well - 'move' now uses File::Copy::move internally instead of the built-in 'rename', allowing it to work across filesystems; it also returns an object for the moved location, allowing chaining - edit_lines_raw now uses a buffered raw I/O layer - edit_lines_utf8 now prefers PerlIO::utf8_strict, if available - lines_utf8 now consistently uses a buffered I/O layer - open*_utf8 now prefers PerlIO::utf8_strict, if available - slurp_utf8 now consistently uses an unbuffered I/O layer Documented - Changed all raw/UTF-8 layer descriptions in method documentation to match the code - Fixed SYNOPSIS syntax - Documented how to disable TMPDIR when making temp files/dirs Testing - Add additional tilde stringification testing - Fixed tilde expansion tests on Windows - Skip a problematic test case on Cygwin - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of provides/requires - Fix %patch macro. - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.400 bump (rhbz#2246865) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 1.67 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 1.66 bump - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rewrite to use of /builddir/build/BUILDROOT/perl-Pod-Parser-1.67-5.el10.s390x macro - Update license to SPDX format - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix patch macro - Package tests - Remove obsolete if - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Drop support for building with Test::More < 0.88 - Drop redundant buildroot cleaning in %install section - Use %license unconditionally - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 0.29 bump (rhbz#2222620) - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - 0.28 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Specify all dependencies - Fix permissions verbosely - Simplify find commands using -empty and -delete - Make %files list more explicit - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove not used test file - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.204 (rhbz#2159015) - Try to avoid clobbering global error variables when loading test libraries - hash_each now enumates keys in sort() order, to make errors more consistent - Update to 1.202 (rhbz#2158345) - Converted to Dist::Zilla - Test::Deep will now require v5.12, and this may go up; this change allows simplification of the Makefile.PL, which was coping with a mistake made twelve years ago - Use SPDX-format license tag - Package LICENSE file - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Improve version processing - Fix version handling for git commit checks - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.71 - Document and test different behavior regarding Booleans in perl 5.38.0 compared to earlier versions (GH#21) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 0.70 - Stop pointless use of taint-mode in tests, so tests pass when perl is built without taint support - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Spec tidy-up - Use SPDX-format license tag - Use author-independent source URL - Fix permissions verbosely - Simplify find command using -delete - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.017 - Update packaging and metadata - Use SPDX-format license tag - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix provides in perl-Test-Pod-tests package Resolves: RHEL-68616 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 0.033 - Add Test2 compatibility in the test triggered by done_testing() - New long-awaited feature (!!!) "allow_patterns", to either temporarily or globally exempt particular warning patterns - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.032 - New config variable, $ENV{PERL_TEST_WARNINGS_ONLY_REPORT_WARNINGS}, for temporarily turning failures into reports - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Resolves: RHEL-36643, RHEL-41058 - Move away from xvfb-run - Bump release for June 2024 mass rebuild - Fix failing build and tests - Resolves: RHEL-25977 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fix %patch macro - Update license to SPDX format - Port to C99 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Modernize spec - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Resolves: RHEL-97464 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for fixing TMT tests without discovering dependencies - 0.39 bump - 0.38 bump - 0.37 bump - Resolves: RHEL-97464 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for fixing TMT tests without discovering dependencies - 0.39 bump - 0.38 bump - 0.37 bump - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix filters of dependencies - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.74 (rhbz#2181091) - A few documentation tweaks - Use SPDX-format license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Package tests - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use %license unconditionally - Adapt a spec file to rpm-4.18.92 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for June 2024 mass rebuild - SWIG 4.2 and i686 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update address of b.root-servers.net and some others (#2253462) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 4.9.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.9.0 - Rebuild - Update to upstream version 4.8.0 - Update to upstream version 4.7.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 4.9.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 4.9.0 - Rebuild - Update to upstream version 4.8.0 - Update to upstream version 4.7.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rename plexus-build-api to plexus-build-api0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rename plexus-build-api to plexus-build-api0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52703 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 2.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Update to upstream version 2.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Update to upstream version 2.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Update to upstream version 2.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.14.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 2.14.1 - Convert License tag to SPDX format - Update to upstream version 2.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.2.0 - Drop obsolete plexus-containers-container-default - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Rebuild - Use implicit maven toolchains - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 3.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 3.4.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.0 - Convert License tag to SPDX format - Update to upstream version 1.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.0 - Convert License tag to SPDX format - Update to upstream version 1.1.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 15 - Rebuild - Update to upstream version 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 1.3.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Initial packaging - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Initial packaging - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165336 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Update to upstream version 3.5.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Initial packaging - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Initial packaging - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Convert to SPDX license tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Port configure script to C99 (#2161952) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix path-based dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update po4a to 0.69 (#2157762) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Enable build_with_btrfs on AlmaLinux 10 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - Related: RHEL-168736 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - update to https://github.com/containers/podman/releases/tag/v5.6.0 - Related: RHEL-80817 - update to https://github.com/containers/podman/releases/tag/v5.5.2 - Related: RHEL-80817 - Remove copr related seds from spec - Related: RHEL-80817 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-111943 - Resolves: RHEL-287477 - update to the latest upstream commit bd9083e0 - Resolves: RHEL-271981 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Enable build_with_btrfs on AlmaLinux 10 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel (https://github.com/containers/podman/commit/56f1962) - fixes "Work on RHEL10.1 packaging" - Related: RHEL-80817 - update to the latest content of https://github.com/containers/podman/tree/v5.6 (https://github.com/containers/podman/commit/d46b857) - fixes "Can not find network create and rm message from podman event when set --events-backend to journald" - Related: RHEL-109790 - Enable build_with_btrfs on AlmaLinux 10 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - update to https://github.com/containers/podman/releases/tag/v5.8.1 - fixes Update Podman to support TLS 1.3 configuration - Resolves: RHEL-153732 - enable sequoia - Resolves: RHEL-56365 - update to https://github.com/containers/podman/releases/tag/v5.8.0 - Related: RHEL-122178 - update to rhel-10.1.z version of podman - Related: RHEL-111917 - Enable build_with_btrfs on AlmaLinux 10 - bump golang.org/x/text to v0.39.0 to fix CVE-2026-56852 - Resolves: RHEL-250818 - update to the latest upstream commit 66780e9b - Resolves: RHEL-240087 - Rebuild for golang CVE fixes - Resolves: RHEL-229846 RHEL-240087 RHEL-241164 RHEL-241603 RHEL-241741 RHEL-241990 RHEL-242165 RHEL-242240 RHEL-250818 RHEL-251815 - rebuild for CVE-2026-33810 - Resolves: RHEL-229846 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832 CVE-2026-39835 - fixes CVE-2026-57231 CVE-2026-25681 CVE-2026-27136 - Resolves: RHEL-173842 RHEL-185604 RHEL-185920 RHEL-186263 RHEL-188713 RHEL-190073 RHEL-190857 RHEL-191095 RHEL-191546 RHEL-192440 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167501 - Rebuild for CVE-2026-25679 - Resolves: RHEL-158493 - update to https://github.com/containers/podman/releases/tag/v5.8.2 - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE - Resolves: RHEL-165012 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Update to 24.02.0 - Resolves: #2237549 - update to 24.01.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Update to 24.02.0 - Resolves: #2237549 - update to 24.01.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Update to 24.02.0 - Resolves: #2237549 - update to 24.01.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Update to 24.02.0 - Resolves: #2237549 - update to 24.01.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Migrated to SPDX license - Update to 24.02.0 - Resolves: #2237549 - update to 24.01.9 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565 - Check bitmap in combine() - Resolves: RHEL-131783, RHEL-131782 - Backport fix for issues found by Coverity - Resolves: RHEL-71952 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix crash in broken documents when using -dests - Resolves: RHEL-44326 - Bump release for June 2024 mass rebuild - Update to 16.13 - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length - Resolves: RHEL-149365 RHEL-149399 RHEL-149333 - Update to 16.11 - Resolves: RHEL-128802 (CVE-2025-12818) [rhel-10.2] - Resolves: RHEL-128801 (CVE-2025-12818) [rhel-10.1.z] - Add tmpfiles.d configuration for PostgreSQL 16 - Ensures proper directory permissions for /var/lib/pgsql - Add OpenSSL support to upgrade_configure function - This ensures upgrade server is compiled with OpenSSL support - Required for SSL/TLS connections during database upgrades - Update to 16.10 - Add tmpfiles.d configuration - Update to 16.8 - Fix CVE-2025-1094 - Update to 16.6 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix typos in specfile - Update to 16.14 - Fix CVE-2026-6478 - Update to 16.13 - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length - Resolves: RHEL-149365 RHEL-149399 RHEL-149333 - Update to 16.11 - Resolves: RHEL-128802 (CVE-2025-12818) [rhel-10.2] - Resolves: RHEL-128801 (CVE-2025-12818) [rhel-10.1.z] - Add tmpfiles.d configuration for PostgreSQL 16 - Ensures proper directory permissions for /var/lib/pgsql - Add OpenSSL support to upgrade_configure function - This ensures upgrade server is compiled with OpenSSL support - Required for SSL/TLS connections during database upgrades - Update to 16.10 - Add tmpfiles.d configuration - Update to 16.8 - Fix CVE-2025-1094 - Update to 16.6 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 16.15 - Update to 16.14 - Fix CVE-2026-6478 - Update to 16.13 - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length - Resolves: RHEL-149365 RHEL-149399 RHEL-149333 - Update to 16.11 - Resolves: RHEL-128802 (CVE-2025-12818) [rhel-10.2] - Resolves: RHEL-128801 (CVE-2025-12818) [rhel-10.1.z] - Add tmpfiles.d configuration for PostgreSQL 16 - Ensures proper directory permissions for /var/lib/pgsql - Add OpenSSL support to upgrade_configure function - This ensures upgrade server is compiled with OpenSSL support - Required for SSL/TLS connections during database upgrades - Update to 16.10 - Add tmpfiles.d configuration - Update to 16.8 - Fix CVE-2025-1094 - Update to 16.6 - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Update to 18.4 - Fix CVE-2026-6478 - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Update to 18.6 - Fix CVE-2026-18408 - Fix CVE-2026-6464 - Update to 18.4 - Fix CVE-2026-6478 - Update to 18.3 - Enable pltcl - Update gating configuration - Fix CVE-2026-2004: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code - Fix CVE-2026-2005: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code - Fix CVE-2026-2006: PostgreSQL missing validation of multibyte character length executes arbitrary code - Fix CVE-2026-2007: PostgreSQL libpq read out-of-bound buffer error - create user and group using useradd/groupadd - Update to 18.1 - Bump release for gating - Initial commit on c10s - Resolves: RHEL-116546 - Resolves: RHEL-60823, Move potrace-devel to CRB repository - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Resolves: RHEL-35824, convert license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fixed radiusclient parser Resolves: RHEL-44665 - Bump release for June 2024 mass rebuild - Openssl engine API is deprecated for a while thus disable it Resolves: RHEL-33746 - Pre-created upstream default lock dir Resolves: RHEL-35977 - Added missing and recently approved SPDX licenses - Obsolete dropped network-scripts-ppp subpackage - Dropped network scripts - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - ps: etime overflow reappeared with rewritten library - uptime, w: report user sessions only; upstream backport of 734930e47 - Resolves: RHEL-60826 - Resolves: RHEL-141839 - sysctl: returns success even on fail bug - Resolves: RHEL-84138 - free manpage: expand note on negative value with overcommit - Resolves: RHEL-100973 - fix guest tics (backport upstr patch e1df029e6, 3fb34669) - Resolves: RHEL-84051 - new build needed due to old centpkg glitch - Resolves: RHEL-44359 - fixed OSH findings - Resolves: RHEL-44359 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 9.6.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - Update to 9.5.1 - Update to 9.5.0 - SPDX migration of proj-data - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 9.4.1 - Fix doc dir ownership - Update to 9.4.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Converted license tag to SPDX format. - Bump release for October 2024 mass rebuild: - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - update to 1.5.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Converted license tag to SPDX format. - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Disable tests during build that are flaky - Rebuilt for tests directory - Copy patch from c9s to make emacs dependency optional Resolves: RHEL-93236 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Disable tests during build that are flaky - Rebuilt for tests directory - Copy patch from c9s to make emacs dependency optional Resolves: RHEL-93236 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Fix CVE-2026-0994: nested Any messages bypassing recursion depth limits - Disable tests during build that are flaky - Rebuilt for tests directory - Copy patch from c9s to make emacs dependency optional Resolves: RHEL-93236 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - copy gating.yaml from c9s - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate the License tags to SPDX expressions - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate the License tags to SPDX expressions - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - rebuilt - Resolves: RHEL-34668 - Migrate to SPDX license format - Resolves: RHEL-34668 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.11.1. - Update to 2.11.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - remove build dependency on python-railroad-diagrams - Fix regression in pyparsing 3.1.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to pyparsing 3.1.1. Closes rhbz#2215810. - Use new source url - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Declare the license as an SPDX expression - Rebuilt for Python 3.12 - %pyproject_extras_subpkg: Only %ghost the dist-info directory, not the content - That way, accidentally unpackaged files within are reported as errors - %pyproject_save_files: Also save top level typing stub files (.pyi) - Don't exit from pyproject-srpm-macros implementation of %pyproject_buildrequires - Fixes: rhbz#2391290 - On RPM 4.20+ don't put pyproject-macros-specific files in %buildsubdir - Works around https://github.com/rpm-software-management/rpm/issues/3890 - Speed %pyproject_save_files up significantly - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - %pyproject_buildrequires: Do not generate BuildRequires from Requires core metadata fields - That field is deprecated and should include importable module names, not distribution packages - Related: rhbz#2378463 - Fix handling of config_settings in %pyproject_buildrequires - Fix reverted conditional in %pyproject_buildrequires -t/-e Fedora version comparison - Make %pyproject_buildrequires -t/-e and %tox fail when no suitable tox configuration exists - The %pyproject_buildrequires -t/-e case is temporarily allowed on Fedora 40-42 - Requires tox-current-env >= 0.0.16 - Add the -M flag to %pyproject_save_files - The flag can be used to indicate no Python modules should be saved - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - Deprecate the provisional -w flag for %pyproject_buildrequires - Update to version 2.9.0.post0 and revise patches Resolves: RHEL-103664 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Clarify the SPDX License tag - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 6.10.0 Resolves: RHEL-109197 - 6.9.0 Resolves: RHEL-78527 - 6.8.0 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild (qt6) Resolves: RHEL-36430 - Update to 6.7.0 Resolves: RHEL-34661 - Update to snapshot of 6.7.0 Resolves: RHEL-31143 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix build with Python 3.12.3+ - Bump release for June 2024 mass rebuild - Replace snowballstemmer with a dummy implementation - Suppress traceback when importing the weakened sphinxcontrib* dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the tests run when building with Python 3.11.7, 3.12.1 and later - On Fedora, BuildRequire the sphinxcontrib packages to build the documentation - Weaken the runtime dependency on: - python3-sphinxcontrib-applehelp - python3-sphinxcontrib-devhelp - python3-sphinxcontrib-jsmath - python3-sphinxcontrib-htmlhelp - python3-sphinxcontrib-serializinghtml - python3-sphinxcontrib-qthelp - Packages that want to use them during build need to BuildRequire them explicitly - Update to 7.2.6 - Fixes rhbz#2232469 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.0.0 Fixes rhbz#2233302 - Do not BuildRequire python3-sphinxcontrib-httpdomain, it was not needed - Update to 1.2.2 Fixes rhbz#2213220 - Make the package compatible with docutils 0.20+ and Sphinx 7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 1.2.1 Fixes rhbz#2209270 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the License tag (from MIT to BSD-3-Clause) - The upstream project was relicensed in 0.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Convert to pyproject-rpm-macros - The INSTALLER file now says "rpm" instead of "pip" - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - Update to 1.1.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Avoid libfaketime and python-freezegun deps in RHEL builds - Fix DST-related test failures - Update to 2.12.1 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update license expression. - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - New upstream release - Drop patches merged upstream - Add builddep on python3-setuptools for Python 3.12+ - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.25.1 - Update to 1.25.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.24.0 - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild for rhel-10.2 - Fix CVE-2025-67873 (heap buffer overflow) Resolves: RHEL-141553 - Fix CVE-2025-68114 (memory corruption) Resolves: RHEL-137749 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt with java-21-openjdk as default JDK: https://issues.redhat.com/browse/RHEL-34597 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add RHEL gating configuration - CI: Run upstream testsuite - Import CI tests from RHEL - Don't BuildRequire pythran in RHEL - Update to 3.0.9 (rhbz#2268123) - Disable GCC warnings/errors about wrong self casts in final function calls - Use Python 3.13.0a4 PyCFunctionFastWithKeywords - Update to 3.0.8 (rhbz#2255460) - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Enable PAC and BTI hardware protections for aarch64 Resolves: RHEL-84196 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 - Security fix for CVE-2026-87910 Resolves: RHEL-274127 Resolves: RHEL-276240 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.20.1 Resolves: rhbz#2207802 - Declare the license as an SPDX expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Update to 3.9.0 - Fork python-flit-core from the python-flit package - Adjust the License tag to include flit_core/versionno.py's regex (BSD-2-Clause) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Move away from xvfb-run (done by nielsdg@redhat.com in Fedora) - Bump release for June 2024 mass rebuild - Use gtk3 in tests - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.46.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 3.44.1 - Undefine _include_frame_pointers for riscv64 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 3.0.3 - 3.0.2 - 3.0.1 - 3.0.0 - Update to version 3.0.0rc1 - Convert to pyproject macros - Update to 1.27.0 - Resolves: RHEL-77075 - CI: Install more packages from PyPI - Bump release for October 2024 mass rebuild: - CI: Don't skip any tests - they should work with Python 3.12 - CI: Install uv and editables from PyPI: hatchling 1.24 requires them for testing - CI: Clone pyproject-rpm-macros tests from Centos Stream repo - CI: Run pyproject-rpm-macros mocktests - CI: Run upstream unit tests for hatchling - Add gating.yaml - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56804 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Perl 5.40 rebuild - Rebuilt for Python 3.13 - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Enable PAC and BTI hardware protections for aarch64 Resolves: RHEL-84196 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 - Security fix for CVE-2026-87910 Resolves: RHEL-274127 Resolves: RHEL-276240 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - License verified according to the SPDX specification https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix build with pytest 7.2 and tox 4 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the build with Python 3.13 Fixes: rhbz#2246052 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 0.7.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Initial package (rhbz#2111707) - Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing - Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails - Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set - Resolves: RHEL-166864 Include latest fixes in python3-ipatests package - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-146023 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - Resolves: RHEL-145855 Include latest fixes in python3-ipatests package - Resolves: RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - Resolves: RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system) - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-4823 Names of domains from a trusted forest should be compared case-insentive - Resolves: RHEL-140587 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-113778 Command that retrieve and install new CA certificates - Resolves: RHEL-141296 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-141011 Include latest fixes in python3-ipatests package - Resolves: RHEL-119339 Memory leaks in IPA plugins - Resolves: RHEL-120956 Rebase ipa to latest 4.13.x version for RHEL 10.2 - Resolves: RHEL-90121 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-132337 Include latest fixes in python3-ipatests package - Resolves: RHEL-129965 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-129547 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-133342 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-122767 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier - Resolves: RHEL-119628 Include fixes in python3-ipatests - Resolves: RHEL-110204 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM - Resolves: RHEL-119481 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-126761 [RFE] Support storing LWCA private keys on an HSM - Resolves: RHEL-86030 [RFE] ipa-client-automount should have an option to include domain of the machine. - Resolves: RHEL-119617 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118446 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114545 Rebase Samba to the latest 4.23.x release - Resolves: RHEL-109895 Revert allow update of Kerberos master key - Resolves: RHEL-248199 CVE-2026-79678 ipa: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service - Resolves: RHEL-245626 CVE-2026-19550 ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes [rhel-10.2.z] - Resolves: RHEL-245473 CVE-2026-76578 ipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI - Resolves: RHEL-240909 CVE-2026-13097 ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore [rhel-10.2.z] - Resolves: RHEL-240842 CVE-2026-11861 ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships [rhel-10.2.z] - Resolves: RHEL-240821 CVE-2026-73197 ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read [rhel-10.2.z] - Resolves: RHEL-240800 CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [rhel-10.2.z] - Resolves: RHEL-240768 ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] - Resolves: RHEL-238676 ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] - Resolves: RHEL-238673 ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] - Resolves: RHEL-238526 ipa env: support only simple * wildcard [rhel-10.2.z] - Resolves: RHEL-238522 host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] - Resolves: RHEL-238518 ipa-otptoken-import hardening [rhel-10.2.z] - Resolves: RHEL-238516 Remove NetBIOS dependencies in Identity Manager [rhel-10.2.z] - Resolves: RHEL-238510 WebUI Hardening [rhel-10.2.z] - Resolves: RHEL-218853 CVE-2026-18147 ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL - Resolves: RHEL-173375 [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] - Resolves: RHEL-168516 TestIPAMigrationProdMode tests are missing - Resolves: RHEL-155027 Adding a group with 32Bit Idrange fails - Resolves: RHEL-153145 IdM password policy Min lifetime is not enforced when high minlife is set - Resolves: RHEL-166864 Include latest fixes in python3-ipatests package - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-146023 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None)) - Resolves: RHEL-145855 Include latest fixes in python3-ipatests package - Resolves: RHEL-88855 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'" - Resolves: RHEL-43143 ipa-advise client script requires keytab (should just require root access on client system) - Resolves: RHEL-4895 ipa use systemd-sysusers - Resolves: RHEL-4823 Names of domains from a trusted forest should be compared case-insentive - Resolves: RHEL-140587 Support replaceable WebUI artwork for RHEL and CentOS - Resolves: RHEL-113778 Command that retrieve and install new CA certificates - Resolves: RHEL-141296 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks - Resolves: RHEL-141011 Include latest fixes in python3-ipatests package - Resolves: RHEL-119339 Memory leaks in IPA plugins - Resolves: RHEL-120956 Rebase ipa to latest 4.13.x version for RHEL 10.2 - Resolves: RHEL-90121 Add modern WebUI as submodule and enable routing in Apache - Resolves: RHEL-132337 Include latest fixes in python3-ipatests package - Resolves: RHEL-129965 Fix ipatests for kdcproxy after CVE-2025-59088 fix - Resolves: RHEL-129547 Switch IPA to use the PKI python API directly rather than RPC calls - Resolves: RHEL-133342 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service - Resolves: RHEL-122767 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier - Resolves: RHEL-119628 Include fixes in python3-ipatests - Resolves: RHEL-110204 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM - Resolves: RHEL-119481 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class - Resolves: RHEL-126761 [RFE] Support storing LWCA private keys on an HSM - Resolves: RHEL-86030 [RFE] ipa-client-automount should have an option to include domain of the machine. - Resolves: RHEL-119617 test_cacert_manage fails due to expired Let's Encrypt R3 certificate - Resolves: RHEL-118446 ipa: Privilege escalation from host to domain admin in FreeIPA - Related: RHEL-114545 Rebase Samba to the latest 4.23.x release - Update to upstream version 6.4.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to OpenJDK 21 as default JDK/JRE - Drop generated Requires on JRE - Drop subpackages related to Java other than 21 - Resolves: RHEL-49822, RHEL-51276, RHEL-51276 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix flatpak builds of Java packages - Backport upstream patch to fix Flatpak builds - Add support for OpenJDK 21 - Update to 3.1.6 - Security fix for CVE-2025-27516 Resolves: RHEL-85058 - Update to 3.1.5 - Security fix for CVE-2024-56201 - Security fix for CVE-2024-56326 Resolves: RHEL-73095 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 3.1.4 Resolves: RHEL-36213 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.1.3 to fix CVE-2024-22195 - Declare the license as an SPDX expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for June 2024 mass rebuild - SWIG 4.2 and i686 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update address of b.root-servers.net and some others (#2253462) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix CVE-2026-10846: Off-path poisoning attacks due to insufficient query-response matching (RHEL-210690) - Fix for SWIG 4.3.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Remove unneeded openssl/engine.h causing build failures - Explicitly disable openssl engine (RHEL-33736) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - dtc-pylibfdt-libfdt.i-Use-SWIG_AppendOutput.patch [RHEL-64318 RHEL-65448] - dtc-Disable-problematic-waring-flags.patch [RHEL-64318 RHEL-65448] - Resolves: RHEL-64318 ([RHEL10][CS10] dtc fails to build with Swig 4.3.0) - Resolves: RHEL-65448 ([RHEL10][CS10][FTBFS] dtc fails to build on CS10 and RHEL10) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix missing dynamic tags for aarch64 python3 pylibfdt - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Bump release for June 2024 mass rebuild - dtc-Properly-harden-built-packages.patch [RHEL-33493] - Resolves: RHEL-33493 (Annocheck FAIL: bind-now (dtc)) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Don't install a Python .egg - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Add libpfm-ibm-counters.patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix gcc-14 -Werror=calloc-transposed-args compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add libpfm-monaka.patch - Add libpfm-monaka-v1.1.patch - Add libpfm-ibm-counters.patch - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Added CMAKE_PREFIX_PATH to the module file to unsure that CMake projects find the available MPI enabled packages, libraries, executables, etc. - Drop dependency on ftbfs infinipath-psm - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert license tag to SPDX - Own %{_fmoddir}/mpich - Create directories for MPICH package development files - Mpich should own cmake and include install directories - After bumping the epoch, we need to change the subpackage requires to use it - Bump the epoch to support upgrade path from previous versions of RHEL - Bump release for June 2024 mass rebuild - Add support for riscv64 - Update to 5.0.2 - Drop unused BR on infinipath-psm - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.0.1 - Disable building docs in RHEL builds - Update to 5.0.0 - Drops 32-bit i686 support - Drops C++ bindings - Add doc sub-package - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to latest upstream version - update to 0.11.2 rhbz#2227393 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - update to 0.11.1 rhbz#2178386 - update to 0.11.0 rhbz#2164287 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.3.0. - Update to 1.2.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Skip test_emulate_multi_cpu on riscv64 too Resolves: RHEL-93392 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Skip unreliable test_sensors_temperatures - Don't treat sockets as paths in tests - Bump release for June 2024 mass rebuild - Skip unreliable multi-cpu test on ppc64le - Update to 5.9.8 - Fixes: rhbz#2244271 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Declare the license as an SPDX expression - Update to 5.9.5 rhbz#2135931 - Skip unreliable test rhbz#2169395 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - rebuilt - Resolves: RHEL-34668 - Migrate to SPDX license format - Resolves: RHEL-34668 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.11.1. - Update to 2.11.0. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix smoke test by adding .fmf/version file - Add gating configuration and a simple smoke test - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 0.30 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.18.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.17.2 - Fixes: rhbz#2250432 - Update to 2.16.1 - Fixes: rhbz#2229493 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bootstrap for Python 3.12 - Bump release for October 2024 mass rebuild: - Add gating.yaml - Add a simple smoke test - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Confirm the "MIT" license is SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - At least check import the Python module when built --without tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 7.4.3 - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-3-2023-10-24 - Fixes: rhbz#2245983 - Update to 7.4.2 - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-2-2023-09-07 - Fixes: rhbz#2237942 - Update to 7.4.1 - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-1-2023-09-02 - Fixes: rhbz#2236995 - Update to 7.4.0 Resolves: rhbz#2216956 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 0.10.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to new upstream release 2.2.0 (#2242718) - Modernize Python packaging - Declare license as an SPDX expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Bump release for inclusion of the package in CRB10 - Add gating.yaml and tests - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2.10.0 and switch to pyproject macros; Fixes: RHBZ#1747105 - Update to 1.10.2 - Fix rpm-sti-test tests - Bump release for October 2024 mass rebuild: - Add gating.yaml - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix inaccurate RHEL comment - Use pyproject_wheel instead of calling hook directly - Use direct paths instead of activating venvs - Security fix for CVE-2025-47273 - Change the test source location - Bump release for October 2024 mass rebuild: - Add gating.yaml - CI: Make STI tests compatible with EL 10 - Add a simple smoke test - Security fix for CVE-2024-6345 - Bump release for June 2024 mass rebuild - Undo the removal of pkg_resources DeprecationWarning - Update to 69.0.3 - Bump release for October 2024 mass rebuild: - Add gating configuration - Add simple smoke test - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 8.0.4 - Fixes: rhbz#2241772 - Avoid needlesly BuildRequiring python3-rich when not running tests and on RHEL - Update to 8.0.3 (rhbz#2239825) - Update to 8.0.2 (rhbz#2239825) - Bump release for October 2024 mass rebuild: - Add gating configuration - Add simple smoke test - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 8.0.4 - Fixes: rhbz#2241772 - Avoid needlesly BuildRequiring python3-rich when not running tests and on RHEL - Update to 8.0.3 (rhbz#2239825) - Update to 8.0.2 (rhbz#2239825) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix build with Python 3.12.3+ - Bump release for June 2024 mass rebuild - Replace snowballstemmer with a dummy implementation - Suppress traceback when importing the weakened sphinxcontrib* dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the tests run when building with Python 3.11.7, 3.12.1 and later - On Fedora, BuildRequire the sphinxcontrib packages to build the documentation - Weaken the runtime dependency on: - python3-sphinxcontrib-applehelp - python3-sphinxcontrib-devhelp - python3-sphinxcontrib-jsmath - python3-sphinxcontrib-htmlhelp - python3-sphinxcontrib-serializinghtml - python3-sphinxcontrib-qthelp - Packages that want to use them during build need to BuildRequire them explicitly - Update to 7.2.6 - Fixes rhbz#2232469 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix build with Python 3.12.3+ - Bump release for June 2024 mass rebuild - Replace snowballstemmer with a dummy implementation - Suppress traceback when importing the weakened sphinxcontrib* dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the tests run when building with Python 3.11.7, 3.12.1 and later - On Fedora, BuildRequire the sphinxcontrib packages to build the documentation - Weaken the runtime dependency on: - python3-sphinxcontrib-applehelp - python3-sphinxcontrib-devhelp - python3-sphinxcontrib-jsmath - python3-sphinxcontrib-htmlhelp - python3-sphinxcontrib-serializinghtml - python3-sphinxcontrib-qthelp - Packages that want to use them during build need to BuildRequire them explicitly - Update to 7.2.6 - Fixes rhbz#2232469 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 0.7.16 - Provide python3-alabaster - Run a basic import check when this package is built - Update to 0.7.13 - Declare the license as an SPDX expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 2.0.0 Fixes rhbz#2233302 - Do not BuildRequire python3-sphinxcontrib-httpdomain, it was not needed - Update to 1.2.2 Fixes rhbz#2213220 - Make the package compatible with docutils 0.20+ and Sphinx 7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 1.2.1 Fixes rhbz#2209270 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix tests with Sphinx 7.2+ - Fix tests with Sphinx 7.1+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Update to 4.1 Resolves rhbz#2178260 - Initial package - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Security fix for CVE-2025-8194 Resolves: RHEL-106329 - Enable PAC and BTI hardware protections for aarch64 Resolves: RHEL-84196 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Update to 3.12.12 - Security fix for CVE-2025-8291 Resolves: RHEL-128361 - Update to 3.12.15 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 - Security fix for CVE-2026-87910 Resolves: RHEL-274127 Resolves: RHEL-276240 - Update to Python 3.12.14 Resolves: RHEL-227203 - Security fix for CVE-2026-15308 Resolves: RHEL-193771 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224 Resolves: RHEL-167886, RHEL-168120 - Update to 3.12.13 - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672 - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat Related: RHEL-167886, RHEL-168120 - Security fix for CVE-2026-4519 Resolves: RHEL-158079 - Rebuilding previous fixes for different build target Related: RHEL-143057, RHEL-143109, RHEL-144854 - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143057 Resolves: RHEL-143109 Resolves: RHEL-144854 - Security fix for CVE-2025-13836 Resolves: RHEL-140978 - Security fix for CVE-2025-12084 Resolves: RHEL-135387 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix the License tag (from MIT to BSD-3-Clause) - The upstream project was relicensed in 0.4.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Convert to pyproject-rpm-macros - The INSTALLER file now says "rpm" instead of "pip" - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 2025.9.11.17 - Resolves rhbz#2394661 - Update to 2025.9.9.12 - Resolves rhbz#2394059 - Update to 2025.9.8.13 - Resolves rhbz#2393886 - Update to 2025.8.26.11 - Resolves rhbz#2391025 - Update to 2025.8.6.13 - Resolves rhbz#2386867 - Update to 2025.5.9.12 - Resolves rhbz#2362823 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Security fix for CVE-2026-24049 Resolves: RHEL-143630 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Security fix for CVE-2026-24049 Resolves: RHEL-143630 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - CI: call pip3.14 instead of pip - Update to 3.2.4 - Fixes: rhbz#2427014 - Update to 3.2.1 - Fixes: rhbz#2414622 - Update to 3.1.6 - Fixes: rhbz#2405056 - Update to 3.1.4 - taken from Fedora d26d9ef - Add gating.yaml - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-Cython.spec - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Remove redundant BuildRequires on python3.14-rpm-macros - Disable bootstrap - forgotten variable - Add gating.yaml - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-flit-core.spec - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Add gating.yaml - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-iniconfig.spec - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-meson-python.spec - Revert "Enable bootstrap" - Enable bootstrap - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-packaging.spec - Initial package - Fedora contributions by: Alfredo Moralejo <amoralej@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Matthias Runge <mrunge@redhat.com> Miro Hrončok <mhroncok@redhat.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@fedoraproject.org> Priscila Gutierres <pgutier@redhat.com> Thomas Moschny <thomas.moschny@gmx.de> Tomas Orsava <torsava@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Initial package Fedora contributions by: Ales Nezbeda <anezbeda@redhat.com> Bill Nottingham <notting@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Devrim Gündüz <devrim@gunduz.org> Filip Januš <fjanus@redhat.com> Honza Horak <hhorak@redhat.com> Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Jason L Tibbitts III <tibbs@math.uh.edu> Jesse Keating <jkeating@fedoraproject.org> Jozef Mlich <jmlich@redhat.com> Lumír Balhar <lbalhar@redhat.com> Miro Hrončok <mhroncok@redhat.com> Ondřej Sloup <ondrej.sloup@protonmail.com> Patrik Novotný <panovotn@redhat.com> Pavel Raiskup <praiskup@redhat.com> Petr Kubat <pkubat@redhat.com> Peter Robinson <pbrobinson@fedoraproject.org> Todd Zullinger <tmz@pobox.com> Tomas Hrnciar <thrnciar@redhat.com> Tom Lane <tgl@redhat.com> - Enable tests / disable bootsrap - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-pybind11.spec - Refactor the build script - Drop the python3-python2 distinction - Use standard cmake and pyproject macros (rhbz#2377381) - Allow to build with arbitrary generator (rhbz#2381106) - Rebuilt for Python 3.14.0rc2 bytecode - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Rebuilt for Python 3.14 - Bootstrap for Python 3.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - Enable tests / disable bootsrap - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-pybind11.spec - Refactor the build script - Drop the python3-python2 distinction - Use standard cmake and pyproject macros (rhbz#2377381) - Allow to build with arbitrary generator (rhbz#2381106) - Rebuilt for Python 3.14.0rc2 bytecode - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Rebuilt for Python 3.14 - Bootstrap for Python 3.14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-pyproject-metadata.spec - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-pytest.spec - Fix pytest in gating plan - Add gating.yaml - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-semantic_version.spec - Disable bootstrap - Adjust gating - Generic gating.yaml for all rhel - Use CS repos instead of Fedora - Remove python versions not available on c10s - Test with python-isort - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-setuptools.spec - Add gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-semantic-rust.spec - Disable bootstrap - Adjust gating - Generic gating.yaml for all rhel - Use CS repos instead of Fedora - Remove python versions not available on c10s - Test with python-isort - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-setuptools.spec - Adjust gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-setuptools_scm.spec - Adjust gating - Convert from Fedora for the Python 3.14 stack in RHEL - RHEL: Rename SPEC to python3.14-setuptools_scm.spec - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - Disable bootstrap - Initial package - Fedora contributions by: Björn Esser <besser82@fedoraproject.org> Bohuslav Kabrda <bkabrda@redhat.com> Charalampos Stratakis <cstratak@redhat.com> Dan Horák <dan@danny.cz> David Malcolm <dmalcolm@redhat.com> Dennis Gilmore <dennis@ausil.us> Florian Weimer <fweimer@redhat.com> Gwyn Ciesla <limb@fedoraproject.org> Igor Gnatenko <ignatenkobrain@fedoraproject.org> Iryna Shcherbina <shcherbina.iryna@gmail.com> Jaroslav Škarvada <jskarvad@redhat.com> Jason ティビツ <tibbs@fedoraproject.org> Kalev Lember <klember@redhat.com> Karolina Surma <ksurma@redhat.com> Karsten Hopp <karsten@redhat.com> Lukáš Zachar <lzachar@redhat.com> Lumir Balhar <lbalhar@redhat.com> Marcel Plch <mplch@redhat.com> Matej Stuchlik <mstuchli@redhat.com> Michal Cyprian <mcyprian@redhat.com> Michal Toman <mtoman@fedoraproject.org> Miro Hrončok <mhroncok@redhat.com> Nicolas Chauvet <kwizart@gmail.com> Orion Poplawski <orion@cora.nwra.com> Patrik Kopkan <pkopkan@redhat.com> Peter Robinson <pbrobinson@gmail.com> Petr Šplíchal <psplicha@redhat.com> Petr Viktorin <pviktori@redhat.com> Rex Dieter <rdieter@fedoraproject.org> Richard W.M. Jones <rjones@redhat.com> Robert Kuska <rkuska@redhat.com> Sahana Prasad <sahana@redhat.com> Stephen Gallagher <sgallagh@redhat.com> Than Ngo <than@redhat.com> Thomas Spura <thomas.spura@gmail.com> Till Maas <opensource@till.name> Tom Stellard <tstellar@redhat.com> Tomas Mraz <tmraz@fedoraproject.org> Tomas Orsava <torsava@redhat.com> Tomas Radej <tradej@redhat.com> Tomáš Hrnčiar <thrnciar@redhat.com> Toshio Kuratomi <toshio@fedoraproject.org> U2FsdGVkX1 <U2FsdGVkX1@gmail.com> Victor Stinner <vstinner@redhat.com> Ville Skyttä <ville.skytta@iki.fi> Yaakov Selkowitz <yselkowi@redhat.com> Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Support OpenSSL FIPS mode - Disable the builtin hashlib hashes except blake2 Related: RHEL-120788 - Explicitly require expat >= 2.7.2 - Update to Python 3.14.2 - Update to Python 3.14.1 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Update to Python 3.14.3 - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865, CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367 Resolves: RHEL-144855, RHEL-143058, RHEL-143111 - Update to Python 3.14.8 - Security fix for CVE-2026-15310 - Security fix for CVE-2026-15806 - Security fix for CVE-2026-17084 - Security fix for CVE-2026-19445 - Security fix for CVE-2026-19553 - Security fix for CVE-2026-19672 - Security fix for CVE-2026-82049 Resolves: RHEL-274128 Resolves: RHEL-276241 - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227190 - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227190 - Update to Python 3.14.6 Related: RHEL-227190 - Security fix for CVE-2026-15308 Resolves: RHEL-193775 - Update to 3.14.5 Resolves: RHEL-176147 - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147 - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100 Resolves: RHEL-168121, RHEL-167887 - Update to Python 3.14.4 - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865 Related: RHEL-168121, RHEL-167887 - Security fix for CVE-2026-4519 Resolves: RHEL-158114 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52713 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Port to OpenJDK 21 - Resolves: RHEL-52713 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Update to upstream version 2.1.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.0.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - AlmaLinux change: Set arch as x86_64_v2 for config file - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - fix plan definition - fix static analysis findings (RHEL-44568) - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - add signature file - Update to 1.23.2 - add tarball signature verification - updated to 1.22.0 - AlmaLinux change: Set arch as x86_64_v2 for config file - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - fix plan definition - fix static analysis findings (RHEL-44568) - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - add signature file - Update to 1.23.2 - add tarball signature verification - updated to 1.22.0 - AlmaLinux change: Set arch as x86_64_v2 for config file - Bump release for October 2024 mass rebuild: - Related: RHELMISC-3914 - fix plan definition - fix static analysis findings (RHEL-44568) - Related: RHELMISC-3914 - add gating.yaml file - Bump release for June 2024 mass rebuild - add signature file - Update to 1.23.2 - add tarball signature verification - updated to 1.22.0 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2257313 - qpdf-11.8.0 is available - 2255755 - qpdf-11.7.0 is available - 2254778 - remove the tests which fail with zlib-ng-compat for now - 2253901 - qpdf-11.6.4 is available - 2244319 - qpdf-11.6.3 is available - 2242670 - qpdf-11.6.2 is available - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 2257313 - qpdf-11.8.0 is available - 2255755 - qpdf-11.7.0 is available - 2254778 - remove the tests which fail with zlib-ng-compat for now - 2253901 - qpdf-11.6.4 is available - 2244319 - qpdf-11.6.3 is available - 2242670 - qpdf-11.6.2 is available - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78529 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31145 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78530 - 6.9.1 Resolves: RHEL-78530 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31146 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Fix out-of-bounds read in QTextCodec::codecForName() (CVE-2026-9499) Resolves: RHEL-247204 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78530 - 6.9.1 Resolves: RHEL-78530 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - QSsl: add support for ML-DSA signature algorithm Resolves: RHEL-97008 - 6.9.1 Resolves: RHEL-78531 - Fix emoji rendering issue Resolves: RHEL-76300 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Sync with Fedora: - fix directory ownership - install cmake modules for plugins - depend on pkgconfig(egl) rather than mesa-libEGL-devel Resolves: RHEL-73681 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Move libcupsprintersupport back to -gui as it depends on gui libs Resolves: RHEL-53982 - Move all mkspecs to -devel Resolves: RHEL-53982 - Move more stuff into -private-devel Resolves: RHEL-53982 - Do not install ExamplesAssetDownloader Resolves: RHEL-53982 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - QSsl: add support for ML-DSA signature algorithm Resolves: RHEL-97008 - 6.9.1 Resolves: RHEL-78531 - Fix emoji rendering issue Resolves: RHEL-76300 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Sync with Fedora: - fix directory ownership - install cmake modules for plugins - depend on pkgconfig(egl) rather than mesa-libEGL-devel Resolves: RHEL-73681 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Move libcupsprintersupport back to -gui as it depends on gui libs Resolves: RHEL-53982 - Move all mkspecs to -devel Resolves: RHEL-53982 - Move more stuff into -private-devel Resolves: RHEL-53982 - Do not install ExamplesAssetDownloader Resolves: RHEL-53982 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - QSsl: add support for ML-DSA signature algorithm Resolves: RHEL-97008 - 6.9.1 Resolves: RHEL-78531 - Fix emoji rendering issue Resolves: RHEL-76300 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Sync with Fedora: - fix directory ownership - install cmake modules for plugins - depend on pkgconfig(egl) rather than mesa-libEGL-devel Resolves: RHEL-73681 - Backport additional fixes for emoji support Resolves: RHEL-4218 - Move libcupsprintersupport back to -gui as it depends on gui libs Resolves: RHEL-53982 - Move all mkspecs to -devel Resolves: RHEL-53982 - Move more stuff into -private-devel Resolves: RHEL-53982 - Do not install ExamplesAssetDownloader Resolves: RHEL-53982 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78532 - Rebuild (broken buildroot) Resolves: RHEL-78532 - 6.9.1 Resolves: RHEL-78532 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78533 - Rebuild (broken buildroot) Resolves: RHEL-78533 - 6.9.1 Resolves: RHEL-78533 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Rebuild (broken buildroot) Resolves: RHEL-78534 - 6.9.1 Resolves: RHEL-78534 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31150 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - Bump release for June 2024 mass rebuild - VectorImage: sanitize source string used in output (CVE-2025-14576) Resolves: RHEL-173494 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - Bump release for June 2024 mass rebuild - VectorImage: sanitize source string used in output (CVE-2025-14576) Resolves: RHEL-173494 - 6.10.1 Resolves: RHEL-109197 - Backport - CMake: Do not automatically link against Qt6::QmlPrivate Resolves: RHEL-78535 - 6.9.1 Resolves: RHEL-78535 - Drop runtime dependency on qt6-qtbase-private-devel Resolves: RHEL-77748 - Install CMake modules for plugins Resolves: RHEL-73682 - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0 Workaround for rhbz#2330219 Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Do not own /usr/lib[64]/qml directory Resolves: RHEL-50036 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78538 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31154 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78540 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Backport Qt 6.7.1 fix for ABI breakage Resolves: RHEL-33606 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31156 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78541 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31157 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78542 - 6.9.1 Resolves: RHEL-78542 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Disable tests for i686 architecture - 6.10.1 Resolves: RHEL-109197 - Fix CVE-2025-11277 in bundled assimp library Resolves: RHEL-120979 - 6.9.1 Resolves: RHEL-78543 - Fix directory ownership Resolves: RHEL-74027 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31159 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78545 - Rebuild (broken buildroot) Resolves: RHEL-78545 - 6.9.1 Resolves: RHEL-78545 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78546 - Rebuild (broken buildroot) Resolves: RHEL-78546 - 6.9.1 Resolves: RHEL-78546 - Fix directory ownership Resolves: RHEL-74029 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78547 - Rebuild (broken buildroot) Resolves: RHEL-78547 - 6.9.1 Resolves: RHEL-78547 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78548 - 6.9.1 Resolves: RHEL-78548 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78549 - Rebuild (broken buildroot) Resolves: RHEL-78549 - 6.9.1 Resolves: RHEL-78549 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78551 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Install source files for examples Resolves: RHEL-27845 Resolves: RHEL-31167 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31167 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Upstream backport: Don't add outlines to text when there is none Resolves: RHEL-78552 - 6.9.1 Resolves: RHEL-78552 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31168 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.10.1 Resolves: RHEL-109197 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.9.1 Resolves: RHEL-78553 - Rebuild (LLVM-20) Resolves: RHEL-81776 - Fix directory ownership Resolves: RHEL-74026 - Add versioned deps to -examples Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Fix build against LLVM 19 Resolves: RHEL-64941 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix unit tests (rebuild for qt6-macros) Resolves: RHEL-35968 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.10.1 Resolves: RHEL-109197 - Rebuild (LLVM-21) Resolves: RHEL-108338 - 6.9.1 Resolves: RHEL-78553 - Rebuild (LLVM-20) Resolves: RHEL-81776 - Fix directory ownership Resolves: RHEL-74026 - Add versioned deps to -examples Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Fix build against LLVM 19 Resolves: RHEL-64941 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix unit tests (rebuild for qt6-macros) Resolves: RHEL-35968 - 6.10.1 Resolves: RHEL-109197 - 6.9.1 Resolves: RHEL-78555 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31171 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - 6.10.1 Resolves: RHEL-109197 - Add pointer warp support Resolves: RHEL-78556 - 6.9.1 Resolves: RHEL-78556 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - 6.7.0 Resolves: RHEL-27845 Resolves: RHEL-31172 Resolves: RHEL-33724 - Add -tests subpackage with unit tests that can run in CI Resolves: RHEL-28239 - 6.10.1 Resolves: RHEL-109197 - Add the missing linking of CorePrivate to WebChannelQuick module Resolves: RHEL-78557 - Re-enable tests Resolves: RHEL-78557 - 6.9.1 Resolves: RHEL-78557 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.10.1 Resolves: RHEL-109197 - Re-enable tests Resolves: RHEL-78558 - 6.9.1 Resolves: RHEL-78558 - Re-enable tests Resolves: RHEL-53982 - 6.8.1 Resolves: RHEL-53982 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Add rpminspect.yaml Resolves: RHEL-36430 - Enable tests subpackage Resolves: RHEL-36430 - 6.7.1 Resolves: RHEL-36430 - Bump release for SPDX rebuild - Relates: RHEL-119534 - Build quota to verify gating - Relates: RHEL-71489 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add tmpfs quota support - Fix quota-tools on XFS - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Drop requires on java-headless - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52704 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Initial build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Initial build - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Port to maven-plugin-annotations from Javadoc tags - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild without generated Requires - Bump release for June 2024 mass rebuild - Port to maven-plugin-annotations from Javadoc tags - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation) Resolves: RHEL-213749 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Initial the rhel-10 gating tests (RHEL-45007) - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix OpenSSL 3.5 dependency - Rebase to 1.10.1 - Require OpenSSL 3.5 - Include MD5 in ossl bindings and sequoia-openpgp for RPM - Build 1.9.0 version with ossl bindings to unbreak FIPS - Pull PQC crypto to rpm-sequoia - gating: added CI plans - Bump release for October 2024 mass rebuild: - RHEL-10 CI and gating setup - Bump release for June 2024 mass rebuild - Rebase to 1.10.2 and sequioa-openpgp with fixes for CVE-2026-42784 - Fix OpenSSL 3.5 dependency - Rebase to 1.10.1 - Require OpenSSL 3.5 - Include MD5 in ossl bindings and sequoia-openpgp for RPM - Build 1.9.0 version with ossl bindings to unbreak FIPS - Pull PQC crypto to rpm-sequoia - gating: added CI plans - Bump release for October 2024 mass rebuild: - RHEL-10 CI and gating setup - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Converted license to SPDX - Fixed FTBFS with GCC 14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Added recently approved SPDX exception rrdtool-floss-exception-2.0 Resolves: RHEL-38985 - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171244 - Upgrade to Ruby 3.3.10. Resolves: RHEL-130160 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL-122028 - Upgrade to Ruby 3.3.8. Resolves: RHEL-87342 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86116 - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221) - Upgrade to Ruby 3.3.7 Resolves: RHEL-77994 - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version. Resolves: RHEL-21019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to Ruby 3.3.5 Resolves: RHEL-59035 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57047 Resolves: RHEL-57059 Resolves: RHEL-57070 - Fix REXML DoS when parsing an XML having many specific characters such as whitespace character, >] and ]>. (CVE-2024-41123) Resolves: RHEL-52802 - Bump release for June 2024 mass rebuild - Upgrade to Ruby 3.3.1. Resolves: RHEL-33975 - Fix buffer overread vulnerability in StringIO. Resolves: RHEL-34124 - Fix RCE vulnerability with .rdoc_options in RDoc. Resolves: RHEL-34116 - Fix arbitrary memory address read vulnerability with Regex search. Resolves: RHEL-33866 - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181775 - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258) Resolves: RHEL-181797 - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171245 - Upgrade to Ruby 3.3.10. Resolves: RHEL-130160 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL-122028 - Upgrade to Ruby 3.3.8. Resolves: RHEL-87342 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86116 - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221) - Upgrade to Ruby 3.3.7 Resolves: RHEL-77994 - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version. Resolves: RHEL-21019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to Ruby 3.3.5 Resolves: RHEL-59035 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57047 Resolves: RHEL-57059 Resolves: RHEL-57070 - Fix REXML DoS when parsing an XML having many specific characters such as whitespace character, >] and ]>. (CVE-2024-41123) Resolves: RHEL-52802 - Bump release for June 2024 mass rebuild - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659 - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181775 - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258) Resolves: RHEL-181797 - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171245 - Upgrade to Ruby 3.3.10. Resolves: RHEL-130160 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL-122028 - Upgrade to Ruby 3.3.8. Resolves: RHEL-87342 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86116 - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221) - Upgrade to Ruby 3.3.7 Resolves: RHEL-77994 - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version. Resolves: RHEL-21019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to Ruby 3.3.5 Resolves: RHEL-59035 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57047 Resolves: RHEL-57059 Resolves: RHEL-57070 - Fix REXML DoS when parsing an XML having many specific characters such as whitespace character, >] and ]>. (CVE-2024-41123) Resolves: RHEL-52802 - Fix memory exhaustion via unknown DNS resource types in resolv. (CVE-2026-80212) Resolves: RHEL-252031 - Upgrade to Ruby 3.3.12. Resolves: RHEL-211300 Resolves: RHEL-193659 - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181775 - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258) Resolves: RHEL-181797 - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316) Resolves: RHEL-171245 - Upgrade to Ruby 3.3.10. Resolves: RHEL-130160 - Fix possible denial of service in resolv gem (CVE-2025-24294) - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594) - Fix REXML denial of service. (CVE-2025-58767) Resolves: RHEL-122028 - Upgrade to Ruby 3.3.8. Resolves: RHEL-87342 - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186) - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219) Resolves: RHEL-86116 - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221) - Upgrade to Ruby 3.3.7 Resolves: RHEL-77994 - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version. Resolves: RHEL-21019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Upgrade to Ruby 3.3.5 Resolves: RHEL-59035 - Fix DoS vulnerability in rexml. (CVE-2024-39908) (CVE-2024-41946) (CVE-2024-43398) Resolves: RHEL-57047 Resolves: RHEL-57059 Resolves: RHEL-57070 - Fix REXML DoS when parsing an XML having many specific characters such as whitespace character, >] and ]>. (CVE-2024-41123) Resolves: RHEL-52802 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56804 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - Perl 5.40 rebuild - Rebuilt for Python 3.13 - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Initial package. Resolves: RHEL-133550 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Upgrade to Ruby 4.0.1. Resolves: rhbz#2428861 - Upgrade to Ruby 4.0.0. Resolves: rhbz#2425358 - Update to Ruby 3.4.8. Resolves: rhbz#2422963 Resolves: rhbz#2412227 - Upgrade to Ruby 3.4.7. Resolves: rhbz#2402422 - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves: CVE-2025-58767 - Upgrade to Ruby 3.4.5. Resolves: rhbz#2380246 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Upgrade to Ruby 3.4.4. Resolves: rhbz#2359563 - Fix the tests using SHA-1 Probabilistic Signature Scheme (PSS) parameters. Resolves: rhbz#2358256 - Upgrade to Ruby 4.0.3. Resolves: RHEL-171239 - Fix ERB: Arbitrary code execution via bypass (CVE-2026-41316) Resolves: RHEL-170910 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) Resolves: RHEL-173457 - Initial package. Resolves: RHEL-133550 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Upgrade to Ruby 4.0.1. Resolves: rhbz#2428861 - Upgrade to Ruby 4.0.0. Resolves: rhbz#2425358 - Update to Ruby 3.4.8. Resolves: rhbz#2422963 Resolves: rhbz#2412227 - Upgrade to Ruby 3.4.7. Resolves: rhbz#2402422 - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves: CVE-2025-58767 - Upgrade to Ruby 3.4.5. Resolves: rhbz#2380246 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Upgrade to Ruby 3.4.4. Resolves: rhbz#2359563 - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-181767 - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments (CVE-2026-42258) Resolves: RHEL-181793 - Upgrade to Ruby 4.0.3. Resolves: RHEL-171239 - Fix ERB: Arbitrary code execution via bypass (CVE-2026-41316) Resolves: RHEL-170910 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) Resolves: RHEL-173457 - Initial package. Resolves: RHEL-133550 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Upgrade to Ruby 4.0.1. Resolves: rhbz#2428861 - Upgrade to Ruby 4.0.0. Resolves: rhbz#2425358 - Update to Ruby 3.4.8. Resolves: rhbz#2422963 Resolves: rhbz#2412227 - Upgrade to Ruby 3.4.7. Resolves: rhbz#2402422 - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves: CVE-2025-58767 - Upgrade to Ruby 3.4.5. Resolves: rhbz#2380246 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660 - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-181767 - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments (CVE-2026-42258) Resolves: RHEL-181793 - Upgrade to Ruby 4.0.3. Resolves: RHEL-171239 - Fix ERB: Arbitrary code execution via bypass (CVE-2026-41316) Resolves: RHEL-170910 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) Resolves: RHEL-173457 - Initial package. Resolves: RHEL-133550 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Upgrade to Ruby 4.0.1. Resolves: rhbz#2428861 - Upgrade to Ruby 4.0.0. Resolves: rhbz#2425358 - Update to Ruby 3.4.8. Resolves: rhbz#2422963 Resolves: rhbz#2412227 - Upgrade to Ruby 3.4.7. Resolves: rhbz#2402422 - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves: CVE-2025-58767 - Upgrade to Ruby 3.4.5. Resolves: rhbz#2380246 - Fix resolv: do not register on-demand classes for unknown DNS types and SvcParamKeys to prevent memory exhaustion (CVE-2026-80212) Resolves: RHEL-252032 - Upgrade to Ruby 4.0.6. Resolves: RHEL-211310 Resolves: RHEL-193660 - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-181767 - Fix Net::IMAP command injection vulnerability via unvalidated Symbol arguments (CVE-2026-42258) Resolves: RHEL-181793 - Upgrade to Ruby 4.0.3. Resolves: RHEL-171239 - Fix ERB: Arbitrary code execution via bypass (CVE-2026-41316) Resolves: RHEL-170910 - Fix JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210) Resolves: RHEL-173457 - Initial package. Resolves: RHEL-133550 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - Upgrade to Ruby 4.0.1. Resolves: rhbz#2428861 - Upgrade to Ruby 4.0.0. Resolves: rhbz#2425358 - Update to Ruby 3.4.8. Resolves: rhbz#2422963 Resolves: rhbz#2412227 - Upgrade to Ruby 3.4.7. Resolves: rhbz#2402422 - Fix URI Credential Leakage Bypass previous fixes. Resolves: CVE-2025-61594 - Fix REXML denial of service. Resolves: CVE-2025-58767 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for June 2024 mass rebuild - Adapt tests to mariadb 10.11 - Avoid rubygem-eventmachine build dependency in RHEL - Adapt tests to openssl 3.2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Upgrade to rubygem-mysql2 0.5.5. Resolves: rhbz#2163026 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.2 - Fix the broken SSL tests with MariaDB 10.5.18. Resolves: rhbz#2144488 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - Upgrade to pg 1.5.4. Resolves: rhbz#2173399 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.2 - Update to pg 1.4.5. Resolves: rhbz#2099059 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix one failing test related to thread local variable - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.2 - Disable unwanted dependencies in RHEL builds - 3.12.1 - Disable GC related test, with the advice from ruby upstream - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Remove unneeded conditionals for new MiniTest support - Support MiniTest 5.19+ - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.3 - Disable unwanted dependencies in RHEL builds - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.6 - 3.12.5 - 3.12.4 - Disable unwanted dependencies in RHEL builds - 3.12.3 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - 3.13.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - 3.12.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Backport upstrem patch for pending broken test with ruby >= 3.1.3 - Pull upstream patch (under review) for ruby filer deadlock treatment - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Remove libldb dependency to samba-common-libs - resolves: RHEL-132975 - Update to version 4.23.4 - resolves: RHEL-114545 - Update to version 4.23.4 - resolves: RHEL-132338 - Fix Time Machine backup - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Update to version 4.23.5 - resolves: RHEL-138263 - Fix winbind group resolution - resolves: RHEL-141012 - Fix winbind crash - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - Fix winbind memory leak seen with long living rpcd_* workers - resolves: RHEL-144479 - Fix winbind lsa_OpenPolicy() lsa connection failure (NT_STATUS_RPC_CANNOT_SUPPORT) - resolves: RHEL-267435 - Fix winbind mkhomedir ownership handling - resolves: RHEL-180758 - Bump build number - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156279 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161644 - CVE-2026-4480 - Fix Samba printing - resolves: RHEL-170595 - CVE-2026-40170 - Update bundled ngtcp2 - resolves: RHEL-166871 - Add stack protection with FORTIFY_SOURCE - Fix 'net ads join' AD replication race with multiple DCs - resolves: RHEL-169668 - Fix samba automount triggering for more file systems - resolves: RHEL-137446 - Fix regression with --use-kerberos=desired for smbclient - resolves: RHEL-150820 - Fix 'net ads kerberos kinit' to use default ccache name from krb5.conf - resolves: RHEL-147417 - Fix samba-bgqd to load [printers] share - resolves: RHEL-53167 - Fix 'net ads kerberos kinit -P' with option '--use-krb5-ccache' - resolves: RHEL-144586 - new upstream release - new upstream release - restore useradd and groupadd in place of sysusers rpm macros - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - new nodelay flag for add_lockspace - new upstream release - fix install of sanlock.sysusers - fix invalid strcpy in direct dump - new upstream release, adopt sysusers, drop python bindings - Bump release for June 2024 mass rebuild - Bump release to address sbc-devel inclusion to CRB Resolves: RHEL-105436 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update license tag in subpackage to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix bogus date in changelog, use autopatch - Add pointer casts for GCC 14/C89 compatibility - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Add downstream patch to fix c99 incompatibilities - https://fedoraproject.org/wiki/Changes/PortingToModernC - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.2.68 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix a hang in SDL_FreeYUVOverlay() (RH#2173510) - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.2.60 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t Resolves: RHEL-193860 - Label /run/coreos with coreos_installer_var_run_t Resolves: RHEL-193859 - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() Resolves: RHEL-193859 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Add the rpm_signal() interface Related: RHEL-107589 - Allow tuned_t use its private tmpfs files Related: RHEL-107589 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-93731 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-116041 - Confine redfish_finder - host api discovery service Resolves: RHEL-50299 - Update policy for dhcpc_hook_t Resolves: RHEL-113937 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113937 - Allow systemd to map files under /sys Resolves: RHEL-132638 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t Resolves: RHEL-193860 - Label /run/coreos with coreos_installer_var_run_t Resolves: RHEL-193859 - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() Resolves: RHEL-193859 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Add the rpm_signal() interface Related: RHEL-107589 - Allow tuned_t use its private tmpfs files Related: RHEL-107589 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-93731 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-116041 - Confine redfish_finder - host api discovery service Resolves: RHEL-50299 - Update policy for dhcpc_hook_t Resolves: RHEL-113937 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113937 - Allow systemd to map files under /sys Resolves: RHEL-132638 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Label bootloader-migrate-generator with coreos_bootloader_migrate_generator_exec_t Resolves: RHEL-193860 - Label /run/coreos with coreos_installer_var_run_t Resolves: RHEL-193859 - Add systemd_create_generator_unit_file() and systemd_write_generator_unit_file() Resolves: RHEL-193859 - Allow virtqemud_t get priority of a svirt_t process Resolves: RHEL-224484 - Remove permissive domain for sshd_session_t and sshd_auth_t Resolves: RHEL-178897 - Replace "\_" (backslash underscore) with "_" (just underscore) Resolves: RHEL-171367 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Rebuild because of a missing target tag Resolves: RHEL-152308 - Rebuild for SELinux userspace 3.10 - Allow NetworkManager list bpf directories Resolves: RHEL-142171 - Dontaudit systemd-generator connect to sssd over a unix stream socket Resolves: RHEL-114886 - Allow pkcsslotd read files in /proc and /sys Resolves: RHEL-130812 - Allow pkcsslotd map its private tmpfs files Resolves: RHEL-130812 - Allow tlshd communication to unconfined_t over a tcp socket Resolves: RHEL-125106 - Label /run/insights-client.ppid with insights_client_run_t Resolves: RHEL-146687 - Allow NM nvme dispatcher script start systemd services Resolves: RHEL-140760 - Allow tlshd write generic certificate dirs Resolves: RHEL-127023 - Allow aide get attributes of tmpfs and devtmpfs filesystems Resolves: RHEL-121479 - Allow plasma login manager stop login services Resolves: RHEL-140911 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 Resolves: RHEL-143926 - Move triggerin scriptlets to the parent packages Resolves: RHEL-141813 - Rebuild policy before running {binsbin|varrun}-convert.sh Resolves: RHEL-141813 - Rebuild selinux policy after installation of the extra package Resolves: RHEL-135875 - Allow rhsmcertd read anaconda run files Resolves: RHEL-141391 - Allow mdadm to use CAP_BPF during RAID monitoring Resolves: RHEL-135765 - Allow mdadm the CAP_SYS_PTRACE capability Resolves: RHEL-135765 - Allow staff and sysadm execute iotop using sudo Resolves: RHEL-134940 - Allow kernel_t to read/write all domains' pipes Resolves: RHEL-124442 - Allow nfsd_t domain setuid and setgid capability for rpc.mountd Resolves: RHEL-148107 - Allow sshd-session inherit limits from its parent sshd process Resolves: RHEL-136673 - Revert "Allow sshd-session inherit limits from its parent process" Resolves: RHEL-136673 - Allow tlshd write generic certificates Resolves: RHEL-123737 - Allow systemd-hostnamed to create its Varlink socket Resolves: RHEL-139385 - Update gpg_role() interface with unix_stream_socket permissions Resolves: RHEL-128555 - Label /etc/aliases.cdb with etc_aliases_t Resolves: RHEL-109976 - Add aliases.lmdb to mta_filetrans_named_content() Resolves: RHEL-140884 - Update policy for bootupd Resolves: RHEL-141391 - Macros: Require only "stable" version of selinux-policy (RHEL-141423) - Allow hostapd write to socket files in /tmp Resolves: RHEL-77047 - Allow stap server read virtual memory sysctls Resolves: RHEL-114104 - Allow sshd-session inherit limits from its parent process Resolves: RHEL-136673 - Allow sshd noatsecure on sshd-session execution Resolves: RHEL-138247 - Allow sshd-net read and write to sshd vsock socket Related: RHEL-138247 - Update ktls policy Resolves: RHEL-123737 - Update policy for redfish-finder Resolves: RHEL-50299 - Allow sshd-session read, write, and map ica tmpfs files Resolves: RHEL-138247 - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t Resolves: RHEL-127721 - Allow stalld map sysfs files Resolves: RHEL-135512 - Allow aide get attributes of a filesystem with extended attributes Resolves: RHEL-121479 - Label miscellaneous /dev/papr-* devices Resolves: RHEL-129839 - Allow KDE Plasma Login Manager to function as a display manager Resolves: RHEL-135676 - Update specfile trigger for openwsmand Resolves: RHEL-133024 - Add the rpm_signal() interface Related: RHEL-107589 - Allow tuned_t use its private tmpfs files Related: RHEL-107589 - Allow samba-bgqd send to smbd over a unix datagram socket Resolves: RHEL-93731 - Allow kdump search kdumpctl_tmp_t directories Resolves: RHEL-116041 - Confine redfish_finder - host api discovery service Resolves: RHEL-50299 - Update policy for dhcpc_hook_t Resolves: RHEL-113937 - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t Resolves: RHEL-113937 - Allow systemd to map files under /sys Resolves: RHEL-132638 - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607) - Install missing 00-scsi-sg3_config.rules - Fix file references to other udev rules - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Really add gating.yaml - Add gating.yaml - Disable NVMe support - update to version 1.48 (rhbz#1944444) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188123) - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607) - Install missing 00-scsi-sg3_config.rules - Fix file references to other udev rules - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rescan-scsi-bus.sh.8 manpage links to external domain (RHEL-261865) - sg_inq: avoid including NULL-bytes in SCSI name strings (RHEL-261874) - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188123) - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607) - Install missing 00-scsi-sg3_config.rules - Fix file references to other udev rules - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - passwd.c: lock, open, close and unlock passwd database Resolves: RHEL-151055 Resolves: RHEL-150955 - passwd.c: add audit messages for passwd. Resolves: RHEL-141919 - groupmod.c: --help wfix. Resolves: RHEL-105779 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172 - Disable nscd. Resolves: RHEL-56355 - useradd: fix write_full() return value - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix static analyzer detected issues. Resolves: RHEL-35383 - Rebase to version 4.15.0 - getdef: avoid spurious error messages about unknown configuration options - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Migrate to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Add plexus-container-default alias - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 0.9.0~M2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 0.9.0~M2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild to regenerate auto-Requires on java - Convert License tag to SPDX format - Build with default JDK 17 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fix building with cmocka >= 1.1.6 - Update to version 1.4.0 * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update license to SPDX format and fix licenses - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild for shipping devel subpackage in CRB - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Added upstream patch to fix BZ 2256374. - Rebuilt for Boost 1.83 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Boost 1.81 - Stop adding 'cxx' language mapping (fixed upstream) - Add 'rpm-spec' (used in asciidoc) mapping - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Conditionalize the festival subpackage, we're not shipping Festival in RHEL 10 Festival in RHEL 10) - Bump release for June 2024 mass rebuild - Fix split -libs upgrades - Split out libs and adjust dependencies - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Have utils require pulseaudio-utils as it's the default. - 0.11.5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add licenses to fully conform with SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change the License tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 1.4.328.1 SDK - Update to SDK v1.4.313 SDK - Update to 1.4.304.0 SDK - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to 1.3.283.0 SDK - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Enable building for ppc64le - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebase to Fedora Rawhide resolves: RHEL-56806 - Bump release for June 2024 mass rebuild - OCaml 5.2.0 ppc64le fix - OCaml 5.2.0 for Fedora 41 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream version 5.3.4 - Remove patches which are now all upstream. - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - Resolves: RHEL-82838 - Fix Python DeprecationWarning - Python 3.14 support - Resolves: RHEL-66938 - Fix precedence of casts - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-64313 - 4.3.0 bump - Resolves: RHEL-32325 - 4.2.1 bump - Fix gcc's -Wformat-security warning in R Raise function - OCaml 5.2.0 ppc64le fix - Add support for Python 3.13 - Bump release for June 2024 mass rebuild - 4.2.0 bump - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - Fix PHP director_classes testcase failures on x86 - Resolves: RHEL-82838 - Fix Python DeprecationWarning - Python 3.14 support - Resolves: RHEL-66938 - Fix precedence of casts - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-64313 - 4.3.0 bump - Resolves: RHEL-32325 - 4.2.1 bump - Fix gcc's -Wformat-security warning in R Raise function - OCaml 5.2.0 ppc64le fix - Add support for Python 3.13 - Bump release for June 2024 mass rebuild - 4.2.0 bump - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - Fix PHP director_classes testcase failures on x86 - Resolves: RHEL-82838 - Fix Python DeprecationWarning - Python 3.14 support - Resolves: RHEL-66938 - Fix precedence of casts - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-64313 - 4.3.0 bump - Resolves: RHEL-32325 - 4.2.1 bump - Fix gcc's -Wformat-security warning in R Raise function - OCaml 5.2.0 ppc64le fix - Add support for Python 3.13 - Bump release for June 2024 mass rebuild - 4.2.0 bump - OCaml 5.1.1 + s390x code gen fix for Fedora 40 - OCaml 5.1.1 rebuild for Fedora 40 - Fix PHP director_classes testcase failures on x86 - Update to 47.2 - build: fix a s390 test - update patches to sysprof-el10 branch - Backport ifdef check for register knowledge - Lower libpanel requirement for s390 - Backport debuginfod and sysprof-live-unwinder - Update to Sysprof 47.1 - Bump release for October 2024 mass rebuild: - Only bundle libunwind on RHEL like systems - Bundle libunwind as part of Sysprof - Upgrade to v1.13.1 Resolves: RHEL-72785 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 45.0 - Update to 45.rc - Add -devel subpackage for newly added pkg-config file - Update to 45.beta - Package up translations - Add check section for desktop-file-validate and meson tests - Initial Fedora packaging - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuild (icu) - Rebuild for ICU 74 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 5.3.4 - Update to 5.3.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild (mingw-icu) - Update to 5.3.2 - Resolves: CVE-2026-73066 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 7.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Port to Google Guice 5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuild - Update to upstream version 7.8.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild with no changes - Port to Google Guice 5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Make tainted data safe Resolves: RHEL-43596 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory/resource leaks, insufficient memory allocations and variable declarations without initializer Resolves: RHEL-43595 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to texinfo-7.1 Resolves: #2244846 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Update to texinfo-7.0.3 Resolves: #2181837 - Fix possible use of an undefined value as an ARRAY reference in ParserNonXS.pm (causes FTBFS of a2ps) Resolves: #2171433 - Make tainted data safe Resolves: RHEL-43596 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix memory/resource leaks, insufficient memory allocations and variable declarations without initializer Resolves: RHEL-43595 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to texinfo-7.1 Resolves: #2244846 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Update to texinfo-7.0.3 Resolves: #2181837 - Fix possible use of an undefined value as an ARRAY reference in ParserNonXS.pm (causes FTBFS of a2ps) Resolves: #2171433 - Exclude tex4ht-java classes for i686 as it requires javac for building - Resolves: RHEL-70243, remove xdvi due to removal of X11 in ghostscript - Resolves: RHEL-69757, fix python-sphinx FTBFS - Add two subpackages for texlive 2024: firstaid, hypcap can't find latex2e-first-aid-for-external-files.ltx file - Drop luajittex Resolves: RHEL-65862 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - include luajit for x86_64 only as it only supports this arch - fix requirement on tex-kpathsea, texlive-base - fix unicode issues - add rpminspect.yaml Related: RHEL-59868 - removed obsoleted patch - fixed file conflicts in bibtex, oberdiek, xetex, attachfile, xepersian - fixed texlive-docindex conflict with texlive-base Related: RHEL-59868 Resolves: RHEL-53483, RHEL-53786 - Resolves: RHEL-59868, update to texlive-2024 - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - Exclude tex4ht-java classes for i686 as it requires javac for building - Resolves: RHEL-70243, remove xdvi due to removal of X11 in ghostscript - Resolves: RHEL-69757, fix python-sphinx FTBFS - Add two subpackages for texlive 2024: firstaid, hypcap can't find latex2e-first-aid-for-external-files.ltx file - Drop luajittex Resolves: RHEL-65862 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - include luajit for x86_64 only as it only supports this arch - fix requirement on tex-kpathsea, texlive-base - fix unicode issues - add rpminspect.yaml Related: RHEL-59868 - removed obsoleted patch - fixed file conflicts in bibtex, oberdiek, xetex, attachfile, xepersian - fixed texlive-docindex conflict with texlive-base Related: RHEL-59868 Resolves: RHEL-53483, RHEL-53786 - Resolves: RHEL-59868, update to texlive-2024 - Resolves: RHEL-45900, convert license to SPDX - Fixed eufm font mapping - Added missing license and fixed file list in texlive-plain Related: RHEL-34826 - Bump release for June 2024 mass rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - what's this? a new release? okay. - Converted license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix C89 compatibility issues (GCC 14 build failure) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove implicit ints and implicit function declarations - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix C89 compatibility issues (GCC 14 build failure) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Remove implicit ints and implicit function declarations - Support added for post-quantum cryptography Resolves: RHEL-93093 - Update OpenSSL certificates set up Resolves: RHEL-86503 - Remove deprecated path from systemd service file Resolves: RHEL-86502 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add epoch prefix to version-release in requires - Add rpminspect.yaml to adjust configuration for rpminspect run Resolves: RHEL-56884 - Bump release for June 2024 mass rebuild - Add riscv64 support - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuild for Konflux (Resolves: RHEL-84822) - Rebuild for Konflux - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Fall back to 'getent passwd' when SHELL is unset Resolves: RHEL-152803 - Update to 0.3 Resolves: RHEL-117476 - Update to 0.2 - Fix CVE-2025-23266, CVE-2025-23267, and GHSA-fv92-fjc5-jj9h or GO-2025-3787 Resolves: RHEL-104450 - Update to 0.1.2 Resolves: RHEL-95210 - Add 'Requires: flatpak-session-helper' Resolves: RHEL-97099 - Update to 0.1.1 Resolves: RHEL-61904 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update to 0.0.99.6 Resolves: RHEL-61579 - Rebuild for CVE-2024-24791 Resolves: RHEL-47199 - Silence 'rpminspect --tests=stack-prot' - Silence 'rpminspect --tests=annocheck' (part 2) Resolves: RHEL-33522 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Migrate license to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 3.0.0 - Backport upstream fixes Resolves: RHEL-94936 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Version bump - Resolves: RHEL-54173 - Remove OpenSSL engine API dependency - Resolves: RHEL-54173 - Bump release for June 2024 mass rebuild - Update to 4.1.3 Resolves: RHEL-23207 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Split out fapi subpackage Resolves: rhbz#2252535 - Migrate license to SPDX - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Disable stemmer support as libstemmer is being removed from RHEL 10 - Update to 3.7.3 and sync with Fedora - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.7.alpha - Backport upstream patch to fix C compatibility issue in Meson probe - Update to 3.6.0 - Update to 3.6.rc - Update to 3.6.beta - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Disable stemmer support as libstemmer is being removed from RHEL 10 - Update to 3.7.3 and sync with Fedora - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 3.7.alpha - Backport upstream patch to fix C compatibility issue in Meson probe - Update to 3.6.0 - Update to 3.6.rc - Update to 3.6.beta - Fix bugs found by SAST - Resolves: RHEL-62754 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Version bump - Resolves: RHEL-54174 - Update to 2.3.2 - Resolves: RHEL-54174 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license - Updates to release 2.1 - migrated to SPDX license - resolves: rhbz#2219549* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 1:1.6.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Set fp-contract for riscv64 - New upstream release 3.0.2 (Fixes RHBZ#2256228 and RHBZ#2166459 and RHBZ#2208448) - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Set fp-contract for riscv64 - New upstream release 3.0.2 (Fixes RHBZ#2256228 and RHBZ#2166459 and RHBZ#2208448) - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Correct License tag for SPDX migration. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.0.8 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Correct License tag for SPDX migration. - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.0.8 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update License to SPDX expression - Fix building with cmocka >= 1.1.6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to version 1.3.0 o https://gitlab.com/cwrap/uid_wrapper/-/blob/uid_wrapper-1.3.0/CHANGELOG - Recreate configure unconditionally - Add byacc into BuildRequires - Change the default of tls-use-system-policy-versions at build-time - Switch TLS configuration to follow TLS sockets by crypto-policy again - Export utils subpackage into AppStream repository - Add Yorgos PGP key for validation - Update to 1.24.2 - Fixes CVE-2025-11411 - Add new DNSSEC root anchor 38696 - Make root.key maintained unmodified - Create root key if missing automatically - Fix CVE-2026-42959 - Fix CVE-2026-42944 - Fix CVE-2026-33278 - Recreate configure unconditionally - Add byacc into BuildRequires - Change the default of tls-use-system-policy-versions at build-time - Switch TLS configuration to follow TLS sockets by crypto-policy again - Export utils subpackage into AppStream repository - Add Yorgos PGP key for validation - Update to 1.24.2 - Fixes CVE-2025-11411 - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance - Fix CVE-2026-41292: DoS via excessive EDNS options - Add upstream unit test for CVE-2026-40622 - Fix CVE-2026-44390: DoS with large RRsets - Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack - Fix CVE-2026-42959 - Fix CVE-2026-42944 - Fix CVE-2026-33278 - Recreate configure unconditionally - Add byacc into BuildRequires - Add unit tests for CVE-2026-{44690,55973} - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance - Fix CVE-2026-41292: DoS via excessive EDNS options - Add upstream unit test for CVE-2026-40622 - Fix CVE-2026-44390: DoS with large RRsets - Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack - Fix CVE-2026-42959 - Fix CVE-2026-42944 - Backport additional fix of locks during initialization - Fix CVE-2026-50252: prevent cache poisoning via shared ports - Add unit tests for CVE-2026-{44690,55973} - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance - Fix CVE-2026-41292: DoS via excessive EDNS options - Add upstream unit test for CVE-2026-40622 - Fix CVE-2026-44390: DoS with large RRsets - Fix CVE-2026-40622: cache manipulation via 'ghost domain names' attack - Prevent heap corruption during CNAME synthesis (CVE-2026-82717) - Prevent heap buffer overflow during DNSSEC canonicalization (CVE-2026-81634) - Prevent heap buffer overflow when digesting DNSKEY (CVE-2026-81642) - Add unit test for the vulnerability too - Backport additional fix of locks during initialization - Fix CVE-2026-50252: prevent cache poisoning via shared ports - Add unit tests for CVE-2026-{44690,55973} - Fix CVE-2026-55973: dns-error-reporting stack buffer overflow - Fix CVE-2026-44690 - Cross-zone wildcard cache poisoning - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance - Fix CVE-2026-41292: DoS via excessive EDNS options - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-49439 - Update the license tag to Unicode-3.0 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Unicode 15.1 released - add license.txt - update to draft 15.1.0: https://unicode.org/versions/Unicode15.1.0/ - do not add copyright.html file from website - add missing Unicode-TOU license tag - Migrate to SPDX license expression - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52705 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Fix out-of-bounds stack write (GCC 14 compatibility) - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX migration - New Release 2.3.12 (lurcher) - Don't check state with shared env (lurcher) - Add --enable-singleenv option (lurcher) - Allow longer messages via SQLGetDiag (lurcher) - Add --enable-utf8ini flag and coding (lurcher) - Fix possible seg faults with SQLAPI and pooling (lurcher) - Fix possible seg faults with SQLAPI and pooling (lurcher) - Remove self-reference (Stefan) - Avoid implicit function declarations, for C99 compatibility (Florian Weimer) - Fix --enable-stats config error (lurcher) - Allow diagnostics to be retrieved on SQL_NO_DATA (Kevin Adler) - isql.1: Add information about passwords containing semicolons (Hugh McMaster) - isql.1: Various text updates (Hugh McMaster) - Export __clear_ini_cache from libodbcinst (lurcher) - Revert "Add call to atexit to clear the ini cache" (lurcher) - Add call to atexit to clear the ini cache (lurcher) - Add extra iusql connectionstring syntax (lurcher) - Allow longer connection strings (part 3) (lurcher) - Allow longer connection strings (part 2) (lurcher) - Allow longer connection strings (lurcher) - Fixed Connection String (Stefan) - Add extra connection syntax to isql help (lurcher) - Add extra logging for ODBCINST connect settings (lurcher) - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (and report warning) (lurcher) - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (lurcher) - Allow passing complete connection string into iusql (lurcher) - Remove __get_connection from cursor lib (lurcher) - Avoid failed build if clock_gettime() is not available (lurcher) - Update change log (lurcher) - DriverManager/_info.c: Get locale encoding on Windows. (Markus Mützel) - DriverManager/drivermanager.h: fix build without threads (Fabrice Fontaine) - Fix iconv handle leak with pooling (lurcher) - Fix buffer overrun (lurcher) - Create SECURITY.md (Nick Gorham) - Move to 2.3.12pre (lurcher) - Makefile.am: Do not install config.h (Hugh McMaster) - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Port to C99 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - The resource leak fixes - Update to the upstream version 1.90.10 - Update to the upstream version 1.90.9 - Fix unstable OnBattery status - Update to the upstream version 1.90.8 - Update to 1.90.8 - README and HACKING were renamed to README.md and HACKING.md - Support zsh-completion - Resolve memory leak when connecting/disconnecting and refreshing the battery info. - test: Fix incorrect test script - Bump release for October 2024 mass rebuild: - Update to upstream version 1.90.6 - Update to the upstream version 1.90.6 - Include a fix patch for "incorrect external device battery update" issue. Link: https://gitlab.freedesktop.org/upower/upower/- /commit/7d7bb84fde91bef9ee7eba924cbdfa74639cc4fe - Bump release for June 2024 mass rebuild - Add gating definition for RHEL-10 - RHEL-32340 Update to release 1.90.4 - The resource leak fixes - Update to the upstream version 1.90.10 - Update to the upstream version 1.90.9 - Fix unstable OnBattery status - Update to the upstream version 1.90.8 - Update to 1.90.8 - README and HACKING were renamed to README.md and HACKING.md - Support zsh-completion - Resolve memory leak when connecting/disconnecting and refreshing the battery info. - test: Fix incorrect test script - Bump release for October 2024 mass rebuild: - Update to upstream version 1.90.6 - Update to the upstream version 1.90.6 - Include a fix patch for "incorrect external device battery update" issue. Link: https://gitlab.freedesktop.org/upower/upower/- /commit/7d7bb84fde91bef9ee7eba924cbdfa74639cc4fe - Bump release for June 2024 mass rebuild - Add gating definition for RHEL-10 - RHEL-32340 Update to release 1.90.4 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - SPDX migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add OSCI tests and gating.yaml - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - migrated to SPDX license - New upstream release - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - migrate to SPDX license - BR: perl-interpreter rather than perl - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Use standard Fedora linker flags (bug #1548666) https://src.fedoraproject.org/rpms/uuid/pull-request/1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Perl 5.38 rebuild - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuilt for CRB inclusion Resolves: RHEL-135109 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to 1.26.1 - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Update to 0.56.18 Resolves: RHEL-88019 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Address rpminspect findings and also don't require Devhelp for help as it won't be in RHEL 10. - Update to 0.56.17 - Update to 0.56.16 - Update to 0.56.15 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Downgrade GCC 14 -Wint-conversion errors to warnings - Downgrade GCC 14 C type errors to warnings - Resolves: RHEL-121816 - Image mode: fix creation of /var files - Resolves: RHEL-45756 - Varnish consumes significantly more memory under RHEL8/9 - Resolves: RHEL-89691 - varnish: request smuggling attacks (CVE-2025-47905) - Resolves: RHEL-59267 - varnish rebase to 7.6.1 - Resolves: RHEL-59267 - varnish rebase to 7.6.0 - Resolves: RHEL-30333 CVE-2024-30156 varnish: HTTP/2 Broken Window Attack may result in denial of service - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - New upstream release. A security release - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Update to upstream version 2.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Update to virt-v2v-2.10.0-17 - mlcustomize firstboot: be more careful about quoting and create a sentinel file when firstboot completes - Add --no-fstrim option to disable fstrim during conversion - convert: stop using maxmem (xfs_repair -m option) - mldrivers/firmware.ml: ignore CHS geometry error from parted (Veritas/Sun partitions) - docs: show input parameters for -i input methods - docs: -i disk allows multiple disk images - -i disk: allow nbd:// URIs for input disks - Fix binary LUKS keys (read_whole_file, text: and base64: key prefixes) - Windows firstboot: add exit code 250 to skip reboots - smp: use cgroup CPU limits for appliance SMP - Fix location of Windows Vista and Windows 2008 Server R1 drivers - Require libguestfs >= 1:1.58.1-6 (text:/base64 LUKS prefixes) - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-50563 - Fix installation of QEMU Guest Agent resolves: RHEL-50563 - New upstream development version 2.5.5 resolves: RHEL-46869 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - -i libvirtxml: Add -io nbd-tls-certificates for NBD disks resolves: RHEL-276238 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Update to virt-v2v-2.10.0-17 - mlcustomize firstboot: be more careful about quoting and create a sentinel file when firstboot completes - Add --no-fstrim option to disable fstrim during conversion - convert: stop using maxmem (xfs_repair -m option) - mldrivers/firmware.ml: ignore CHS geometry error from parted (Veritas/Sun partitions) - docs: show input parameters for -i input methods - docs: -i disk allows multiple disk images - -i disk: allow nbd:// URIs for input disks - Fix binary LUKS keys (read_whole_file, text: and base64: key prefixes) - Windows firstboot: add exit code 250 to skip reboots - smp: use cgroup CPU limits for appliance SMP - Fix location of Windows Vista and Windows 2008 Server R1 drivers - Require libguestfs >= 1:1.58.1-6 (text:/base64 LUKS prefixes) - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Rebase to virt-v2v 2.8.1 related: RHEL-81735 - Fix virt-v2v -v --install dnf5 error resolves: RHEL-83288 - Print blkhash of converted image in virt-v2v debugging output resolves: RHEL-85514 - Document dracut network-legacy conversion failure resolves: RHEL-55732 - Print nbdcopy command in debug output resolves: RHEL-86088 - Remove usage of nbdkit-cacheextents-filter resolves: RHEL-88860 - Print better mountpoint stats in debug output resolves: RHEL-88862 - Remove several ancient, deprecated options resolves: RHEL-88867 - virt-v2v-inspector is failing on snapshots of running VMs resolves: RHEL-88544 - Add virt-v2v-open tool resolves: RHEL-89993 - Run filesystem check before and after conversion resolves: RHEL-91931 - virt-v2v fails to convert XFS guest with dirty filesystem resolves: RHEL-95365 - virt-v2v fails to convert guests with e2fsck errors resolves: RHEL-97600 - Improve layout of man page resolves: RHEL-99745 - Fix xfs_repair out of memory error resolves: RHEL-99313 - Remove virt-v2v -io vddk-noextents=true option resolves: RHEL-102619 - Add -o kubevirt -oo disk and -oo create options resolves: RHEL-101599 - Fix escaping of nbdkit-vddk-plugin export parameter resolves: RHEL-102734 - Fix installation of drivers on firstboot with pending reboots resolves: RHEL-103356 - Log the version of libnbd / nbdcopy in virt-v2v output resolves: RHEL-104018 - Fix SELinux relabelling in Linux split-/usr resolves: RHEL-109130 - Set boot order for Linux guests based on grub location resolves: RHEL-108991 - Rebase to virt-v2v 2.7.1 resolves: RHEL-56814 - Replace Jansson with json-c resolves: RHEL-65297 - Find drivers for win2025 guests resolves: RHEL-65009 - in-place: Add new -O option to write inspector XML resolves: RHEL-70538 - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper resolves: RHEL-78505 - convert: Use yum/apt/... for package removals resolves: RHEL-78657 - convert: windows: Online all virtio disks at first boot resolves: RHEL-56318 - Further fixes for QEMU Guest Agent install & VMware Tools removal resolves: RHEL-50563 - Fix installation of QEMU Guest Agent resolves: RHEL-50563 - New upstream development version 2.5.5 resolves: RHEL-46869 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Rebase to virt-v2v 2.10.0 resolves: RHEL-111241 - Synchronize spec file with Fedora. - Tighten permissions on windows C:\Program Files\Guestfs resolves: RHEL-104352 - Don't output floppy XML with qemu lacks support resolves: RHEL-90175 - convert: linux: Ignore /etc/lvm/archive/*.vg files resolves: RHEL-113820 - mlcustomize/inject_virtio_win.ml: Use viostor.inf instead of guestor resolves: RHEL-112517 - Fix for setting boot order for Linux guests based on grub location resolves: RHEL-115989, RHEL-115990 - Remove virt-v2v subscription manager options resolves: RHEL-122308 - Handle subdirectories in nbdkit vddk export wildcard resolves: RHEL-121728 - Further fixes for nbdkit vddk export wildcard resolves: RHEL-122753 - Fix ESP conversion if C:\Windows\Temp has alternate case resolves: RHEL-124569 - setfiles runs out of memory in glibc fts_read (doc fix) resolves: RHEL-125116 - Use AV and GPO information from inspection instead of open coding resolves: RHEL-125956 - Remove reduce-memory-pressure=on as workaround for Dell Powermax 8000 resolves: RHEL-135617 - Hard depend on libnbd 1.24 resolves: RHEL-140894 - Add documentation about BitLocker Recovery resolves: RHEL-103915 - Fix regression when converting vmx+ssh with snapshots resolves: RHEL-102938 - Expose XFS version in virt-v2v-inspector resolves: RHEL-144075 - Fix Debian 12 UEFI conversions resolves: RHEL-144467 - Fix import when datastore name has characters like '+' resolves: RHEL-133729 - Replace /etc/crypttab /dev/sdX with UUID resolves: RHEL-93583 - Replace '/' in output name with '_' resolves: RHEL-136479 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Install blnsvr.exe to \Windows\Drivers\VirtIO resolves: RHEL-148423 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - Requires openssl (for finding thumbprint) resolves: RHEL-155204 - Attempt 2 to fix sles12sp5 crypttab resolves: RHEL-93583 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - Create sentinel file after all firstboot scripts have finished running resolves: RHEL-161192 - -i libvirtxml: Add -io nbd-tls-certificates for NBD disks resolves: RHEL-276238 - Allow NBD connections from remote hosts in -i libvirtxml input mode resolves: RHEL-267140 - For Linux conversions use yum/dnf clean_requirements_on_remove=False resolves: RHEL-257319 - Add -it nfc support resolves: RHEL-248249 - Increase timeout resolves: RHEL-252892 - Fix SELinux relabelling of podman rootless containers resolves: RHEL-239852 - Add --selinux-relabel-exclude parameter resolves: RHEL-239809 - Add --selinux-relabel-at-boot parameter resolves: RHEL-RHEL-240649 - Change '::' to 'REM' in Windows batch files for improved reliability resolves: RHEL-239810 - Add <disk> <boot-order>#</boot-order> to XML output resolves: RHEL-193138 - Add new --collect option to collect pre-conversion information resolves: RHEL-192947 - Retry qemu-ga installer on failure resolves: RHEL-193139 - Fix conversions of encrypted Ubuntu guests (second attempt) resolves: RHEL-192921 - Skip fsck after conversion for RHEL 7 resolves: RHEL-192948 - Drop 'Fix conversion of encrypted Ubuntu guests' (failed testing) related: RHEL-174515 - Fix location of Windows Vista and Windows 2008 Server R1 drivers resolves: RHEL-174513 - Fix binary LUKS keys resolves: RHEL-174520 - Windows firstboot: Add exit code 250 to skip reboots Rework documentation for firstboot feature resolves: RHEL-174516 - Use cgroups in SMP calculation resolves: RHEL-174512 - Stop using maxmem (xfs_repair -m option) resolves: RHEL-169321 - Fix CHS geometry error for Veritas/Sun partitions resolves: RHEL-169225 - Add --no-fstrim option resolves: RHEL-164583 - make getting password from backed up secret FIPS compatible (RHEL-146218) - use sequoia instead of gpgme (RHEL-56368) - Make volume_key FIPS compliant Resolves: RHEL-74047 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Update to 0.78.6 - Bump to 0.78.5 - Update to 0.78.4 - Update to VTE 0.78.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Only use bsymbolic on x86_64 - Backport changes from Fedora 40 - Backport changes from Fedora 40 - Update to 0.78.6 - Bump to 0.78.5 - Update to 0.78.4 - Update to VTE 0.78.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Only use bsymbolic on x86_64 - Backport changes from Fedora 40 - Backport changes from Fedora 40 - Update to 1.4.328.1 SDK - Update to 1.4.313 SDK - Update to 1.4.304.0 SDK - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Update to 1.3.283.0 SDK - Add Provides and Obsoletes vulkan-validation-layers-devel - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Disable ASM code parts - Resolves: RHEL-46283 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Add licenses to fully conform to SPDX - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Change the License tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebase to 5.6.0 - Resolves: rhbz#2148994 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Install abseil-cpp headers as well - Resolves: RHEL-28928 - Build abseil-cpp from tarbal - Resolves: RHEL-28928 - Bump release for June 2024 mass rebuild - 1.3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Fix Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) - Resolves: RHEL-272823 - Fix DoS via heap-based buffer overflow in SPDY dissector (CVE-2026-95387) - Resolves: RHEL-272323 - Fix DoS via X.509IF protocol dissector crash (CVE-2026-76928) - Resolves: RHEL-248365 - Fix DoS vulnerability in H.245 protocol dissector (CVE-2026-76927) - Resolves: RHEL-257643 - Fix DoS vulnerability in ESS protocol dissector (CVE-2026-76919) - Resolves: RHEL-257617 - Fix DoS via C12.22 protocol dissector crash (CVE-2026-76886) - Resolves: RHEL-247382 - Fix DoS via RRC protocol dissector out-of-bounds write (CVE-2026-76880) - Resolves: RHEL-245610 - Fix DoS via C12.22 protocol dissector crash (CVE-2026-76879) - Resolves: RHEL-248209 - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory - Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory - Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow - Resolves: RHEL-152922 - CVE-2026-3203 Buffer Over-read - Resolves: RHEL-152913 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation - Resolves: RHEL-136919 - NULL Pointer Dereference in Wireshark (CVE-2025-9817) - Resolves: RHEL-130427 - Access of Uninitialized Pointer in Wireshark - Resolves: RHEL-91194 - RFE - Wireshark with LUA support - Resolves: RHEL-80274 - Increasing NVR due to a build error - Resolves: RHEL-80274 - Uncontrolled Recursion in Wireshark - Resolves: RHEL-93153 - wireshark-cli's %post uses /usr/bin/udevadm but missing systemd-udev - Resolves: RHEL-69442 - Rebase wireshark to 4.4.2 - Resolves: RHEL-68453 - Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark - Resolves: RHEL-68452 - Buffer Over-read in Wireshark - Resolves: RHEL-152921 - CVE-2026-3203 Buffer Over-read - Resolves: RHEL-152912 - CVE-2026-3201 Improperly Controlled Sequential Memory Allocation - Resolves: RHEL-136916 - NULL Pointer Dereference in Wireshark (CVE-2025-9817) - Resolves: RHEL-130425 - Access of Uninitialized Pointer in Wireshark - Resolves: RHEL-91194 - RFE - Wireshark with LUA support - Resolves: RHEL-80274 - Increasing NVR due to a build error - Resolves: RHEL-80274 - Uncontrolled Recursion in Wireshark - Resolves: RHEL-93153 - wireshark-cli's %post uses /usr/bin/udevadm but missing systemd-udev - Resolves: RHEL-69442 - Rebase wireshark to 4.4.2 - Resolves: RHEL-68453 - Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark - Resolves: RHEL-68452 - Buffer Over-read in Wireshark - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Resolves: RHEL-62013 - Improper Handling of Missing Values in Wireshark - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Migrated to SPDX license IDs - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild for regexp update - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Remove proprietary data from source RPM - Resolves: RHEL-40364 - Update to upstream version 2.7.3 - Remove alternatives post striplet - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuild for regexp update - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Remove proprietary data from source RPM - Resolves: RHEL-40364 - Update to upstream version 2.7.3 - Remove alternatives post striplet - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update 1.4.23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Update to 1.4.22 - migrated to SPDX license - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - xcb-proto 1.17.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - xcb-proto 1.16.0 - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for Python 3.12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.4.1. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.4.1. - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Update to 0.4.2. - Update xdg-native-messaging-proxy to upstream 0.1.0 release - Update to 1.20.0 - Update to 1.19.2 - Fix camera portal rejecting camera permission request - Update to 1.19.1 - Bump release for October 2024 mass rebuild: - Bump release for June 2024 mass rebuild - Add gating.yaml via API - Update to 1.18.4 - Migrate to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Bump release for Aug 2024 java mass rebuild - Remove post scriptlet for alternatives - Fix incorrect permissions of xerces-j2-samples.jar - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with default Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Remove BR on java-devel - Bump release for Aug 2024 java mass rebuild - Remove post scriptlet for alternatives - Fix incorrect permissions of xerces-j2-samples.jar - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with default Java - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix license field - Resolves: RHEL-53194 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52706 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Fix license field - Resolves: RHEL-53194 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52706 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating tests - Resolves: RHEL-46771 Rebase to version 1.2.39 Fix openssl engine dependency Stop building gcrypt and gnutls implementations - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Add gating tests - Resolves: RHEL-46771 Rebase to version 1.2.39 Fix openssl engine dependency Stop building gcrypt and gnutls implementations - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Fix build with libxml2-2.12.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Resolves: rhbz#2187631 - Cannot load modules/mod_auth_mellon.so Revert to previous version - Resolves: rhbz#2186304 - rebase to version 1.3.0 - migrated to SPDX license - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update license tag to the SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52707 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Build with Jurand instead of deprecated javapackages-extra - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Use autosetup - Add commons-io to classpath - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to Java 21 for runtime - Resolves: RHEL-52714 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.2 - Enable JPMS provides and JAR transformation in ELN - Rebuild - Use autosetup - Add commons-io to classpath - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch to Java 21 for runtime - Resolves: RHEL-52714 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Update to upstream version 1.2.2 - Enable JPMS provides and JAR transformation in ELN - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Rebuild - Rebuild - Update to upstream version 4.3.0 - Add bindings for XMvn toolchains - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Suggest maven-openjdk21 - Resolves: RHEL-51257 - Bump release for Aug 2024 java mass rebuild - Remove temporary BR on maven-openjdk17 - Add temporary BR on maven-openjdk17 - Remove workaround for rpm bug 447156 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184290 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolves: https://redhat.atlassian.net/browse/RHEL-182443 - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163189 Resolves: https://redhat.atlassian.net/browse/RHEL-163285 Resolves: https://redhat.atlassian.net/browse/RHEL-163243 - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10 Resolves: https://redhat.atlassian.net/browse/RHEL-169767 - Rebuild against xorg-x11-xtrans-devel 1.6.0-1 Resolves: RHEL-117512 - Rebase to Xwayland 24.1.9 (RHEL-120264) - CVE fix for: CVE-2025-62229 (RHEL-119966), CVE-2025-62230 (RHEL-120012), CVE-2025-62231 (RHEL-125005) - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) Rebuild for 10.0.z required due to issue when releasing original erratum. - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505), CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511), CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512), CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516) - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505), CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511), CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512), CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516) - CVE fix for: CVE-2026-55999, CVE-2026-56000 Resolves: https://redhat.atlassian.net/browse/RHEL-191523 Resolves: https://redhat.atlassian.net/browse/RHEL-191533 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184290 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolves: https://redhat.atlassian.net/browse/RHEL-182443 - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163189 Resolves: https://redhat.atlassian.net/browse/RHEL-163285 Resolves: https://redhat.atlassian.net/browse/RHEL-163243 - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10 Resolves: https://redhat.atlassian.net/browse/RHEL-169767 - Rebuild against xorg-x11-xtrans-devel 1.6.0-1 Resolves: RHEL-117512 - Rebase to Xwayland 24.1.9 (RHEL-120264) - CVE fix for: CVE-2025-62229 (RHEL-119966), CVE-2025-62230 (RHEL-120012), CVE-2025-62231 (RHEL-125005) - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) Rebuild for 10.0.z required due to issue when releasing original erratum. - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505), CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511), CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512), CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516) - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536 Resolves: https://redhat.atlassian.net/browse/RHEL-277865 Resolves: https://redhat.atlassian.net/browse/RHEL-277833 Resolves: https://redhat.atlassian.net/browse/RHEL-275766 Resolves: https://redhat.atlassian.net/browse/RHEL-276860 Resolves: https://redhat.atlassian.net/browse/RHEL-276244 Resolves: https://redhat.atlassian.net/browse/RHEL-276400 Resolves: https://redhat.atlassian.net/browse/RHEL-277874 Resolves: https://redhat.atlassian.net/browse/RHEL-277872 Resolves: https://redhat.atlassian.net/browse/RHEL-277853 - CVE fix for: CVE-2026-55999, CVE-2026-56000 Resolves: https://redhat.atlassian.net/browse/RHEL-191518 Resolves: https://redhat.atlassian.net/browse/RHEL-191517 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184290 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolves: https://redhat.atlassian.net/browse/RHEL-182443 - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163189 Resolves: https://redhat.atlassian.net/browse/RHEL-163285 Resolves: https://redhat.atlassian.net/browse/RHEL-163243 - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10 Resolves: https://redhat.atlassian.net/browse/RHEL-169767 - Rebuild against xorg-x11-xtrans-devel 1.6.0-1 Resolves: RHEL-117512 - Rebase to Xwayland 24.1.9 (RHEL-120264) - CVE fix for: CVE-2025-62229 (RHEL-119966), CVE-2025-62230 (RHEL-120012), CVE-2025-62231 (RHEL-125005) - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001 CVE-2026-34002, CVE-2026-34003 Resolves: https://redhat.atlassian.net/browse/RHEL-163190 Resolves: https://redhat.atlassian.net/browse/RHEL-163286 Resolves: https://redhat.atlassian.net/browse/RHEL-163244 - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10 Resolves: https://redhat.atlassian.net/browse/RHEL-169759 - Rebuild against xorg-x11-xtrans-devel 1.6.0-1 Resolves: RHEL-117512 - Rebase to Xwayland 24.1.9 (RHEL-120264) - CVE fix for: CVE-2025-62229 (RHEL-119966), CVE-2025-62230 (RHEL-120012), CVE-2025-62231 (RHEL-125005) - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135), CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147), CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159) Rebuild for 10.0.z required due to issue when releasing original erratum. - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505), CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511), CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512), CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516) - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505), CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511), CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512), CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516) - xwayland 24.1.5 (RHEL-78562) - Fix a regression with keyboard modifiers due to a bug in gamescope - Remove unneeded build dependencies on xorg-x11-util-macros and libXpm - Remove unneeded build dependency on wayland-eglstream-protocols (RHEL-66317) - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Rebuilt to include the package in CRB. See: https://bugzilla.redhat.com/show_bug.cgi?id=2309121 https://issues.redhat.com/browse/RHEL-57593 https://issues.redhat.com/browse/ENGCMP-4434 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - SPDX Migration - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - update to util-macros 1.20.0 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - xtrans 1.6.0 Resolves: RHEL-117511 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Switch Java compiler source/target to 1.8 - Resolves: RHEL-52708 - Bump release for Aug 2024 java mass rebuild - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Convert License tag to SPDX format - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Initial commit on c10s - Resolves: RHEL-60383 - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Update license and move it to SPDX license format - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - Bump release - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Enable tier1 functional gating tests - Update yggdrasil to 0.4.7 - Update yggdrasil to 0.4.6 - Create rhcd.service sym link to yggdrasil.service - Update to 0.4.5 (RHEL-77619) - Rebuild yggdrasil against updated golang - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Rebuild yggdrasil against updated golang - Rebuild yggdrasil against updated golang - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.9.2 - Update yggdrasil to 0.4.9.1 - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Bump release for rebuild - Update yggdrasil to 0.4.9 - Remove gomodulemode export from spec file - Update yggdrasil to 0.4.8 - Enable tier1 functional gating tests - Enable DFLTCC on s390x - Resolves: RHEL-135504 - Enable DFLTCC on s390x - Resolves: RHEL-135504 - Enable DFLTCC on s390x - Resolves: RHEL-135504 - Fix directory traversal in unzip binary - Disable the CVE tests during the check phase - the reproducers for these are downloaded from the github - Resolves: RHEL-105822 - Rebase to 0.13.78 - Related: RHEL-45367 - Related: RHEL-45372 - Bump the release number to trigger the gating tests - Bump release for October 2024 mass rebuild: Resolves: RHEL-64018 - Refresh the gating tests + bump the release number - Add gating tests + bump the release number - Rebase to 0.13.74 - Resolves: RHEL-34805 - Bump release for June 2024 mass rebuild - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild